commit a98ac15765353742ddff62e5ee1e46874742e1f1
Author: Ingo van Lil <[EMAIL PROTECTED]>
Date: Tue Mar 25 02:40:04 2008 +0000
mtd: memory corruption in block2mtd.c
upstream commit: 2875fb65f8e40401c4b781ebc5002df10485f635
The block2mtd driver (drivers/mtd/devices/block2mtd.c) will kfree an
on-stack
pointer when handling an invalid argument line (e.g.
block2mtd=/dev/loop0,xxx).
The kfree was added some time ago when "name" was dynamically allocated.
Signed-off-by: Ingo van Lil <[EMAIL PROTECTED]>
Acked-by: Joern Engel <[EMAIL PROTECTED]>
Cc: David Woodhouse <[EMAIL PROTECTED]>
Cc: Andrew Morton <[EMAIL PROTECTED]>
Signed-off-by: Andrew Morton <[EMAIL PROTECTED]>
Signed-off-by: Linus Torvalds <[EMAIL PROTECTED]>
Signed-off-by: Chris Wright <[EMAIL PROTECTED]>
diff --git a/drivers/mtd/devices/block2mtd.c b/drivers/mtd/devices/block2mtd.c
index be4b994..84038ca 100644
--- a/drivers/mtd/devices/block2mtd.c
+++ b/drivers/mtd/devices/block2mtd.c
@@ -408,7 +408,6 @@ static int block2mtd_setup2(const char *val)
if (token[1]) {
ret = parse_num(&erase_size, token[1]);
if (ret) {
- kfree(name);
parse_err("illegal erase size");
}
}
_______________________________________________
unionfs-cvs mailing list: http://unionfs.filesystems.org/
[email protected]
http://www.fsl.cs.sunysb.edu/mailman/listinfo/unionfs-cvs
