This case is supposed to read from a memory after it has been freed, but we missed freeing base if the memory 'val' could not be allocated.
Signed-off-by: Sudip Mukherjee <[email protected]> --- drivers/misc/lkdtm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/misc/lkdtm.c b/drivers/misc/lkdtm.c index 2f0b022..5b3a63c 100644 --- a/drivers/misc/lkdtm.c +++ b/drivers/misc/lkdtm.c @@ -458,8 +458,10 @@ static void lkdtm_do_action(enum ctype which) break; val = kmalloc(len, GFP_KERNEL); - if (!val) + if (!val) { + kfree(base); break; + } *val = 0x12345678; base[offset] = *val; -- 1.9.1

