diff options
| author |   Miaoqian Lin <linmq006@gmail.com> | 2025-08-28 16:14:57 +0800 |
|---|---|---|
| committer |   Jakub Kicinski <kuba@kernel.org> | 2025-08-29 19:19:39 -0700 |
| commit | 0704a3da7ce50f972e898bbda88d2692a22922d9 (patch) | |
| tree | ee3508904cf30b9d3c4680976bed2ef6de572a11 | |
| parent | ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (diff) | |
| download | wireguard-linux-0704a3da7ce50f972e898bbda88d2692a22922d9.tar.xz wireguard-linux-0704a3da7ce50f972e898bbda88d2692a22922d9.zip | |
mISDN: Fix memory leak in dsp_hwec_enable()
dsp_hwec_enable() allocates dup pointer by kstrdup(arg),
but then it updates dup variable by strsep(&dup, ",").
As a result when it calls kfree(dup), the dup variable may be
a modified pointer that no longer points to the original allocated
memory, causing a memory leak.
The issue is the same pattern as fixed in commit c6a502c22999
("mISDN: Fix memory leak in dsp_pipeline_build()").
Fixes: 9a4381618262 ("mISDN: Remove VLAs")
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250828081457.36061-1-linmq006@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
| -rw-r--r-- | drivers/isdn/mISDN/dsp_hwec.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/isdn/mISDN/dsp_hwec.c b/drivers/isdn/mISDN/dsp_hwec.c index 0b3f29195330..0cd216e28f00 100644 --- a/drivers/isdn/mISDN/dsp_hwec.c +++ b/drivers/isdn/mISDN/dsp_hwec.c @@ -51,14 +51,14 @@ void dsp_hwec_enable(struct dsp *dsp, const char *arg) goto _do; { - char *dup, *tok, *name, *val; + char *dup, *next, *tok, *name, *val; int tmp; - dup = kstrdup(arg, GFP_ATOMIC); + dup = next = kstrdup(arg, GFP_ATOMIC); if (!dup) return; - while ((tok = strsep(&dup, ","))) { + while ((tok = strsep(&next, ","))) { if (!strlen(tok)) continue; name = strsep(&tok, "="); |