Skip to content

Commit

Permalink
drivers/input/evdev.c: don't kfree() a vmalloc address
Browse files Browse the repository at this point in the history
If kzalloc() failed and then evdev_open_device() fails, evdev_open()
will pass a vmalloc'ed pointer to kfree.

This might fix https://bugzilla.kernel.org/show_bug.cgi?id=88401, where
there was a crash in kfree().

Reported-by: Christian Casteyde <casteyde.christian@free.fr>
Belatedly-Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Cc: Henrik Rydberg <rydberg@euromail.se>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  • Loading branch information
Andrew Morton authored and Linus Torvalds committed Dec 3, 2014
1 parent 91b5719 commit 92788ac
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion drivers/input/evdev.c
Original file line number Diff line number Diff line change
Expand Up @@ -421,7 +421,7 @@ static int evdev_open(struct inode *inode, struct file *file)

err_free_client:
evdev_detach_client(evdev, client);
kfree(client);
kvfree(client);
return error;
}

Expand Down

0 comments on commit 92788ac

Please sign in to comment.