From 00f9a89b63151fcf1aa0644bcfe28468ec7e363f Mon Sep 17 00:00:00 2001
From: David Woodhouse <David.Woodhouse@intel.com>
Date: Thu, 14 Mar 2013 13:23:11 +0000
Subject: [PATCH] --- yaml --- r: 375277 b: refs/heads/master c:
 63662139e519ce06090b2759cf4a1d291b9cc0e2 h: refs/heads/master i:   375275:
 d2d2cf670096b3fbbca9d482102e4bcc921409f4 v: v3

---
 [refs]                | 2 +-
 trunk/kernel/params.c | 5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/[refs] b/[refs]
index 4ece17d3e960..67d7f9d5f310 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: fe9ab00f8354a4c388e30301859c5741590c3809
+refs/heads/master: 63662139e519ce06090b2759cf4a1d291b9cc0e2
diff --git a/trunk/kernel/params.c b/trunk/kernel/params.c
index ed35345be536..53b958fcd639 100644
--- a/trunk/kernel/params.c
+++ b/trunk/kernel/params.c
@@ -613,10 +613,13 @@ static __modinit int add_sysfs_param(struct module_kobject *mk,
 		       sizeof(*mk->mp) + sizeof(mk->mp->attrs[0]) * (num+1),
 		       GFP_KERNEL);
 	if (!new) {
-		kfree(mk->mp);
+		kfree(attrs);
 		err = -ENOMEM;
 		goto fail;
 	}
+	/* Despite looking like the typical realloc() bug, this is safe.
+	 * We *want* the old 'attrs' to be freed either way, and we'll store
+	 * the new one in the success case. */
 	attrs = krealloc(attrs, sizeof(new->grp.attrs[0])*(num+2), GFP_KERNEL);
 	if (!attrs) {
 		err = -ENOMEM;