diff options
| author |   Rui Miguel Silva <rui.silva@linaro.org> | 2016-01-08 13:53:47 +0000 |
|---|---|---|
| committer |   Greg Kroah-Hartman <gregkh@google.com> | 2016-01-11 19:18:14 -0800 |
| commit | accad1ba7d62543ab3bcf08813726ea87d237bb6 (patch) | |
| tree | c5fe2f6d38138e1b1118e1b6982a541181325bdf /drivers/staging/greybus/power_supply.c | |
| parent | greybus: power_supply: fix leak getting string properties (diff) | |
| download | linux-dev-accad1ba7d62543ab3bcf08813726ea87d237bb6.tar.xz linux-dev-accad1ba7d62543ab3bcf08813726ea87d237bb6.zip | |
greybus: power_supply: fix use after free of power supply
Individual power supply were being freed and checked using the wrong
pointers and at the wrong place, which would make several issues, like
used after free and so on.
Fix it by freeing all allocated memory after release individual power
supply.
Signed-off-by: Rui Miguel Silva <rui.silva@linaro.org>
Reported-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Johan Hovold <johan@hovoldconsulting.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Diffstat (limited to 'drivers/staging/greybus/power_supply.c')
| -rw-r--r-- | drivers/staging/greybus/power_supply.c | 4 |
1 files changed, 1 insertions, 3 deletions
diff --git a/drivers/staging/greybus/power_supply.c b/drivers/staging/greybus/power_supply.c index 3c9bb12351e4..d985e13b5a0d 100644 --- a/drivers/staging/greybus/power_supply.c +++ b/drivers/staging/greybus/power_supply.c @@ -544,13 +544,10 @@ static void _gb_power_supply_free(struct gb_power_supply *gbpsy) kfree(gbpsy->manufacturer); kfree(gbpsy->props_raw); kfree(gbpsy->props); - kfree(gbpsy); } static void _gb_power_supply_release(struct gb_power_supply *gbpsy) { - if (!gbpsy) - return; gbpsy->update_interval = 0; @@ -576,6 +573,7 @@ static void _gb_power_supplies_release(struct gb_power_supplies *supplies) mutex_lock(&supplies->supplies_lock); for (i = 0; i < supplies->supplies_count; i++) _gb_power_supply_release(&supplies->supply[i]); + kfree(supplies->supply); mutex_unlock(&supplies->supplies_lock); kfree(supplies); } |