summaryrefslogtreecommitdiff
path: root/drivers/misc/lkdtm.c
diff options
context:
space:
mode:
authorSudip Mukherjee <sudipm.mukherjee@gmail.com>2016-04-05 22:41:05 +0530
committerKees Cook <keescook@chromium.org>2016-04-06 16:22:23 -0700
commit50fbd977733d1cbafe75baf4b50424434dcfea8c (patch)
tree57e50b2197e26e3c93bbefdf072a472bc826f52e /drivers/misc/lkdtm.c
parentc4004b02f8e5b9ce357a0bb1641756cc86962664 (diff)
downloadlinux-50fbd977733d1cbafe75baf4b50424434dcfea8c.tar.gz
lkdtm: fix memory leak of val
This case is supposed to read from a page after after it is freed, but it missed freeing val if we are not able to get a free page. Signed-off-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk> Signed-off-by: Kees Cook <keescook@chromium.org>
Diffstat (limited to 'drivers/misc/lkdtm.c')
-rw-r--r--drivers/misc/lkdtm.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/misc/lkdtm.c b/drivers/misc/lkdtm.c
index 5f1a36b8fbb0..2f0b02248761 100644
--- a/drivers/misc/lkdtm.c
+++ b/drivers/misc/lkdtm.c
@@ -498,12 +498,13 @@ static void lkdtm_do_action(enum ctype which)
}
case CT_READ_BUDDY_AFTER_FREE: {
unsigned long p = __get_free_page(GFP_KERNEL);
- int saw, *val = kmalloc(1024, GFP_KERNEL);
+ int saw, *val;
int *base;
if (!p)
break;
+ val = kmalloc(1024, GFP_KERNEL);
if (!val)
break;