From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933833AbYDQB0F (ORCPT ); Wed, 16 Apr 2008 21:26:05 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1760198AbYDQBJO (ORCPT ); Wed, 16 Apr 2008 21:09:14 -0400 Received: from sous-sol.org ([216.99.217.87]:58979 "EHLO sous-sol.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757390AbYDQBJN (ORCPT ); Wed, 16 Apr 2008 21:09:13 -0400 Message-Id: <20080417010309.044818777@sous-sol.org> References: <20080417010122.148289106@sous-sol.org> User-Agent: quilt/0.46-1 Date: Wed, 16 Apr 2008 18:01:25 -0700 From: Chris Wright To: linux-kernel@vger.kernel.org, stable@kernel.org, jejb@kernel.org Cc: Justin Forbes , Zwane Mwaikambo , "Theodore Ts'o" , Randy Dunlap , Dave Jones , Chuck Wolber , Chris Wedgwood , Michael Krufky , Chuck Ebbert , Domenico Andreoli , torvalds@linux-foundation.org, akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk, Ingo van Lil , Joern Engel , David Woodhouse Subject: mtd: memory corruption in block2mtd.c Content-Disposition: inline; filename=mtd-memory-corruption-in-block2mtd.c.patch Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org -stable review patch. If anyone has any objections, please let us know. --------------------- From: Ingo van Lil upstream commit: 2875fb65f8e40401c4b781ebc5002df10485f635 The block2mtd driver (drivers/mtd/devices/block2mtd.c) will kfree an on-stack pointer when handling an invalid argument line (e.g. block2mtd=/dev/loop0,xxx). The kfree was added some time ago when "name" was dynamically allocated. Signed-off-by: Ingo van Lil Acked-by: Joern Engel Cc: David Woodhouse Cc: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Chris Wright --- drivers/mtd/devices/block2mtd.c | 1 - 1 file changed, 1 deletion(-) --- a/drivers/mtd/devices/block2mtd.c +++ b/drivers/mtd/devices/block2mtd.c @@ -408,7 +408,6 @@ static int block2mtd_setup2(const char * if (token[1]) { ret = parse_num(&erase_size, token[1]); if (ret) { - kfree(name); parse_err("illegal erase size"); } } --