diff options
| author |   Lee Jones <lee.jones@linaro.org> | 2016-03-23 14:43:42 +0000 |
|---|---|---|
| committer |   Jassi Brar <jaswinder.singh@linaro.org> | 2016-04-12 13:28:30 +0530 |
| commit | d1c2f87c9a8f79fa8816bbe7de98da38eae2be5e (patch) | |
| tree | f9f90547b42c81aedfbab20531213dfde6e465e7 /drivers/mailbox | |
| parent | mailbox: mailbox-test: Use more consistent format for calling copy_from_user() (diff) | |
| download | linux-dev-d1c2f87c9a8f79fa8816bbe7de98da38eae2be5e.tar.xz linux-dev-d1c2f87c9a8f79fa8816bbe7de98da38eae2be5e.zip | |
mailbox: mailbox-test: Prevent memory leak
If we set the Signal twice or more, without using it as part of a message,
memory will be re-allocated and the pointer over-written. Prevent this
potential leak by only allocating memory when there isn't any already.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
Diffstat (limited to 'drivers/mailbox')
| -rw-r--r-- | drivers/mailbox/mailbox-test.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/drivers/mailbox/mailbox-test.c b/drivers/mailbox/mailbox-test.c index 5f4b439fd45a..58d04726cdd7 100644 --- a/drivers/mailbox/mailbox-test.c +++ b/drivers/mailbox/mailbox-test.c @@ -59,9 +59,12 @@ static ssize_t mbox_test_signal_write(struct file *filp, return -EINVAL; } - tdev->signal = kzalloc(MBOX_MAX_SIG_LEN, GFP_KERNEL); - if (!tdev->signal) - return -ENOMEM; + /* Only allocate memory if we need to */ + if (!tdev->signal) { + tdev->signal = kzalloc(MBOX_MAX_SIG_LEN, GFP_KERNEL); + if (!tdev->signal) + return -ENOMEM; + } if (copy_from_user(tdev->signal, userbuf, count)) { kfree(tdev->signal); |