Skip to contentSkip to conversation

Memory corruption in block2mtd.c

PATCH In review Ingo van Lil 2 participants 2 messages Mar 20, 2008

Subsystems (2)
Memory technology devices (MTD) BLOCK2MTD driver
lore
Share & tools
lore

Ingo van Lil

author
#0 lore raw

PATCH 1/1 Memory corruption in block2mtd.c

Hello everybody,

the block2mtd driver (drivers/mtd/devices/block2mtd.c) will kfree an on-stack pointer when handling an invalid argument line (e.g. block2mtd=/dev/loop0,xxx).

The kfree was added some time ago when "name" was dynamically allocated.

Cheers,
Ingo

Signed-off-by Ingo van Lil <[email protected]>

---

drivers/mtd/devices/block2mtd.c renamed from drivers/mtd/devices/block2mtd.c.orig +0 -1
@@ -408,7 +408,6 @@
 	if (token[1]) {
 		ret = parse_num(&erase_size, token[1]);
 		if (ret) {
-			kfree(name);
 			parse_err("illegal erase size");
 		}
 	}
Acked-by Joern Engel on v1 1/1
#1 lore raw
Quoted 7 lines · Ingo van Lil

the block2mtd driver (drivers/mtd/devices/block2mtd.c) will kfree an on-stack pointer when handling an invalid argument line (e.g. block2mtd=/dev/loop0,xxx).

The kfree was added some time ago when "name" was dynamically allocated.

Good catch.

Quoted 1 line
Signed-off-by Ingo van Lil <[email protected]>
Acked-by Joern Engel <[email protected]>
Quoted 15 lines

---

--- linux-2.6.23.1/drivers/mtd/devices/block2mtd.c.orig 2008-03-20
15:13:49.000000000 +0100
+++ linux-2.6.23.1/drivers/mtd/devices/block2mtd.c 2008-03-20
15:14:09.000000000 +0100

drivers/mtd/devices/block2mtd.c renamed from drivers/mtd/devices/block2mtd.c.orig +0 -2
@@ -408,7 +408,6 @@
 	if (token[1]) {
 		ret = parse_num(&erase_size, token[1]);
 		if (ret) {
-			kfree(name);
 			parse_err("illegal erase size");
 		}
 	}
--
Quoted 4 lines

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

Jörn

Signature · 3 lines
It is the mark of an educated mind to be able to entertain a thought
without accepting it.
-- Aristotle