Skip to content

Commit

Permalink
ppdev: don't print a free'd string
Browse files Browse the repository at this point in the history
A previous fix of a memory leak now prints the string 'name'
that was previously free'd.  Fix this by free'ing the string
at the end of the function and adding an error exit path for
the error conditions.

CoverityScan CID#1384523 ("Use after free")

Fixes: 2bd362d ("ppdev: fix memory leak")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Acked-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  • Loading branch information
Colin Ian King authored and Greg Kroah-Hartman committed Jan 11, 2017
1 parent 5b11ebe commit 0fa2c8e
Showing 1 changed file with 8 additions and 5 deletions.
13 changes: 8 additions & 5 deletions drivers/char/ppdev.c
Original file line number Diff line number Diff line change
Expand Up @@ -290,6 +290,7 @@ static int register_device(int minor, struct pp_struct *pp)
struct pardevice *pdev = NULL;
char *name;
struct pardev_cb ppdev_cb;
int rc = 0;

name = kasprintf(GFP_KERNEL, CHRDEV "%x", minor);
if (name == NULL)
Expand All @@ -298,8 +299,8 @@ static int register_device(int minor, struct pp_struct *pp)
port = parport_find_number(minor);
if (!port) {
pr_warn("%s: no associated port!\n", name);
kfree(name);
return -ENXIO;
rc = -ENXIO;
goto err;
}

memset(&ppdev_cb, 0, sizeof(ppdev_cb));
Expand All @@ -308,16 +309,18 @@ static int register_device(int minor, struct pp_struct *pp)
ppdev_cb.private = pp;
pdev = parport_register_dev_model(port, name, &ppdev_cb, minor);
parport_put_port(port);
kfree(name);

if (!pdev) {
pr_warn("%s: failed to register device!\n", name);
return -ENXIO;
rc = -ENXIO;
goto err;
}

pp->pdev = pdev;
dev_dbg(&pdev->dev, "registered pardevice\n");
return 0;
err:
kfree(name);
return rc;
}

static enum ieee1284_phase init_phase(int mode)
Expand Down

0 comments on commit 0fa2c8e

Please sign in to comment.