recipes-kernel/linux/linux-omap/linus/0039-ISDN-Gigaset-Fix-memory-leak-in-do_disconnect_req.patch

   1 From 7b63a1b5eed2e8f4c90cef7ba893dd95ab1d71ae Mon Sep 17 00:00:00 2001
   2 From: Jesper Juhl <jj@chaosbits.net>
   3 Date: Sun, 26 Dec 2010 09:59:58 +0000
   4 Subject: [PATCH 39/65] ISDN, Gigaset: Fix memory leak in do_disconnect_req()
   5
   6 Hi,
   7
   8 In drivers/isdn/gigaset/capi.c::do_disconnect_req() we will leak the
   9 memory allocated (with kmalloc) to 'b3cmsg' if the call to alloc_skb()
  10 fails.
  11
  12 ...
  13                 b3cmsg = kmalloc(sizeof(*b3cmsg), GFP_KERNEL);
  14         allocation here ------^
  15                 if (!b3cmsg) {
  16                         dev_err(cs->dev, "%s: out of memory\n", __func__);
  17                         send_conf(iif, ap, skb, CAPI_MSGOSRESOURCEERR);
  18                         return;
  19                 }
  20                 capi_cmsg_header(b3cmsg, ap->id, CAPI_DISCONNECT_B3, CAPI_IND,
  21                                  ap->nextMessageNumber++,
  22                                  cmsg->adr.adrPLCI | (1 << 16));
  23                 b3cmsg->Reason_B3 = CapiProtocolErrorLayer1;
  24                 b3skb = alloc_skb(CAPI_DISCONNECT_B3_IND_BASELEN, GFP_KERNEL);
  25                 if (b3skb == NULL) {
  26                         dev_err(cs->dev, "%s: out of memory\n", __func__);
  27                         send_conf(iif, ap, skb, CAPI_MSGOSRESOURCEERR);
  28                         return;
  29         leak here ------^
  30 ...
  31
  32 This leak is easily fixed by just kfree()'ing the memory allocated to
  33 'b3cmsg' right before we return. The following patch does that.
  34
  35 Signed-off-by: Jesper Juhl <jj@chaosbits.net>
  36 Acked-by: Tilman Schmidt <tilman@imap.cc>
  37 Signed-off-by: David S. Miller <davem@davemloft.net>
  38 ---
  39  drivers/isdn/gigaset/capi.c |    1 +
  40  1 files changed, 1 insertions(+), 0 deletions(-)
  41
  42 diff --git a/drivers/isdn/gigaset/capi.c b/drivers/isdn/gigaset/capi.c
  43 index bcc174e..658e75f 100644
  44 --- a/drivers/isdn/gigaset/capi.c
  45 +++ b/drivers/isdn/gigaset/capi.c
  46 @@ -1900,6 +1900,7 @@ static void do_disconnect_req(struct gigaset_capi_ctr *iif,
  47                 if (b3skb == NULL) {
  48                         dev_err(cs->dev, "%s: out of memory\n", __func__);
  49                         send_conf(iif, ap, skb, CAPI_MSGOSRESOURCEERR);
  50 +                       kfree(b3cmsg);
  51                         return;
  52                 }
  53                 capi_cmsg2message(b3cmsg,
  54 --
  55 1.6.6.1
  56