Commit e420637b authored May 20, 2020 by Dan Carpenter Committed by Greg Kroah-Hartman May 21, 2020

w1_therm: Free the correct variable



The problem is that we change "p_args" to point to the middle of the
string so when we free it at the end of the function it's not freeing
the same pointer that we originally allocated.

Fixes: e2c94d6f ("w1_therm: adding alarm sysfs entry")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20200520120019.GA172354@mwanda


Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent c9d7e3da

drivers/w1/slaves/w1_therm.c

+3 −2

Original line number	Diff line number	Diff line
		@@ -1526,8 +1526,9 @@ static ssize_t alarms_store(struct device *device,
		int temp, ret = -EINVAL;
		char *token = NULL;
		s8 tl, th, tt; /* 1 byte per value + temp ring order */
		char *p_args = kmalloc(size, GFP_KERNEL);
		char p_args, orig;

		p_args = orig = kmalloc(size, GFP_KERNEL);
		/* Safe string copys as buf is const */
		if (!p_args) {
		dev_warn(device,
		@@ -1611,7 +1612,7 @@ static ssize_t alarms_store(struct device *device,

		free_m:
		/* free allocated memory */
		kfree(p_args);
		kfree(orig);

		return size;
		}

Admin message