From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933019AbcDERLT (ORCPT ); Tue, 5 Apr 2016 13:11:19 -0400 Received: from mail-pf0-f172.google.com ([209.85.192.172]:35311 "EHLO mail-pf0-f172.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932762AbcDERLR (ORCPT ); Tue, 5 Apr 2016 13:11:17 -0400 From: Sudip Mukherjee To: Arnd Bergmann , Greg Kroah-Hartman , Kees Cook Cc: linux-kernel@vger.kernel.org, Sudip Mukherjee Subject: [PATCH 1/2] lkdtm: fix memory leak of val Date: Tue, 5 Apr 2016 22:41:05 +0530 Message-Id: <1459876266-18023-1-git-send-email-sudipm.mukherjee@gmail.com> X-Mailer: git-send-email 1.9.1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This case is supposed to read from a page after after it is freed, but it missed freeing val if we are not able to get a free page. Signed-off-by: Sudip Mukherjee --- drivers/misc/lkdtm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/misc/lkdtm.c b/drivers/misc/lkdtm.c index 5f1a36b..2f0b022 100644 --- a/drivers/misc/lkdtm.c +++ b/drivers/misc/lkdtm.c @@ -498,12 +498,13 @@ static void lkdtm_do_action(enum ctype which) } case CT_READ_BUDDY_AFTER_FREE: { unsigned long p = __get_free_page(GFP_KERNEL); - int saw, *val = kmalloc(1024, GFP_KERNEL); + int saw, *val; int *base; if (!p) break; + val = kmalloc(1024, GFP_KERNEL); if (!val) break; -- 1.9.1