diff options
author | Sudip Mukherjee <sudipm.mukherjee@gmail.com> | 2016-04-05 17:11:06 (GMT) |
---|---|---|
committer | Kees Cook <keescook@chromium.org> | 2016-04-06 23:22:24 (GMT) |
commit | d2e10088ce01191748857296999b8c24a9a51959 (patch) | |
tree | 9c063da5fdfe44ae4e3ecc8714b89dc69ce2937c /drivers/misc/lkdtm.c | |
parent | 50fbd977733d1cbafe75baf4b50424434dcfea8c (diff) | |
download | linux-d2e10088ce01191748857296999b8c24a9a51959.tar.xz |
lkdtm: fix memory leak of base
This case is supposed to read from a memory after it has been freed,
but we missed freeing base if the memory 'val' could not be allocated.
Signed-off-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
Signed-off-by: Kees Cook <keescook@chromium.org>
Diffstat (limited to 'drivers/misc/lkdtm.c')
-rw-r--r-- | drivers/misc/lkdtm.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/misc/lkdtm.c b/drivers/misc/lkdtm.c index 2f0b022..5b3a63c 100644 --- a/drivers/misc/lkdtm.c +++ b/drivers/misc/lkdtm.c @@ -458,8 +458,10 @@ static void lkdtm_do_action(enum ctype which) break; val = kmalloc(len, GFP_KERNEL); - if (!val) + if (!val) { + kfree(base); break; + } *val = 0x12345678; base[offset] = *val; |