diff options
| author | Martin Fuzzey <mfuzzey@parkeon.com> | 2015-02-19 15:17:44 +0100 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2015-05-09 23:16:31 +0100 |
| commit | 073bfbba54f94f1a9d3f20d5e07d830efe8f8f3a (patch) | |
| tree | 884a061b51af1db31124eb2dc60655ba5a0ed560 /drivers/staging | |
| parent | 1e6775d3670d51f2f50b5fb38ea1facbe1768061 (diff) | |
| download | kernel_samsung_smdk4412-073bfbba54f94f1a9d3f20d5e07d830efe8f8f3a.zip kernel_samsung_smdk4412-073bfbba54f94f1a9d3f20d5e07d830efe8f8f3a.tar.gz kernel_samsung_smdk4412-073bfbba54f94f1a9d3f20d5e07d830efe8f8f3a.tar.bz2 | |
iio: core: Fix double free.
commit c1b03ab5e886760bdd38c9c7a27af149046ffe01 upstream.
When an error occurred during event registration memory was freed twice
resulting in kernel memory corruption and a crash in unrelated code.
The problem was caused by
iio_device_unregister_eventset()
iio_device_unregister_sysfs()
being called twice, once on the error path and then
again via iio_dev_release().
Fix this by making these two functions idempotent so they
may be called multiple times.
The problem was observed before applying
78b33216 iio:core: Handle error when mask type is not separate
Signed-off-by: Martin Fuzzey <mfuzzey@parkeon.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
[bwh: Backported to 3.2:
- Adjust filenames, context
- Drop inapplicable change to iio_free_chan_devattr_list()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'drivers/staging')
| -rw-r--r-- | drivers/staging/iio/industrialio-core.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/staging/iio/industrialio-core.c b/drivers/staging/iio/industrialio-core.c index aec9311..f0abf29 100644 --- a/drivers/staging/iio/industrialio-core.c +++ b/drivers/staging/iio/industrialio-core.c @@ -711,6 +711,7 @@ static void iio_device_unregister_sysfs(struct iio_dev *indio_dev) iio_device_remove_and_free_read_attr(indio_dev, p); } kfree(indio_dev->chan_attr_group.attrs); + indio_dev->chan_attr_group.attrs = NULL; } static const char * const iio_ev_type_text[] = { @@ -986,6 +987,7 @@ static int iio_device_register_eventset(struct iio_dev *indio_dev) error_free_setup_event_lines: __iio_remove_event_config_attrs(indio_dev); kfree(indio_dev->event_interface); + indio_dev->event_interface = NULL; error_ret: return ret; |