diff options
| author | Miaoqian Lin <linmq006@gmail.com> | 2025-08-28 16:14:57 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-09-09 19:02:22 +0200 |
| commit | aaa30b728f346f74897bf949ddd7e1ed12399efc (patch) | |
| tree | bb22adc4059fbef4f4b9c249d6bdd9eb462a3d1e /drivers/isdn | |
| parent | f10d3c7267ac7387a5129d5506c3c5f2460cfd9b (diff) | |
| download | linux-aaa30b728f346f74897bf949ddd7e1ed12399efc.tar.gz linux-aaa30b728f346f74897bf949ddd7e1ed12399efc.tar.bz2 linux-aaa30b728f346f74897bf949ddd7e1ed12399efc.zip | |
mISDN: Fix memory leak in dsp_hwec_enable()
[ Upstream commit 0704a3da7ce50f972e898bbda88d2692a22922d9 ]
dsp_hwec_enable() allocates dup pointer by kstrdup(arg),
but then it updates dup variable by strsep(&dup, ",").
As a result when it calls kfree(dup), the dup variable may be
a modified pointer that no longer points to the original allocated
memory, causing a memory leak.
The issue is the same pattern as fixed in commit c6a502c22999
("mISDN: Fix memory leak in dsp_pipeline_build()").
Fixes: 9a4381618262 ("mISDN: Remove VLAs")
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250828081457.36061-1-linmq006@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/isdn')
| -rw-r--r-- | drivers/isdn/mISDN/dsp_hwec.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/isdn/mISDN/dsp_hwec.c b/drivers/isdn/mISDN/dsp_hwec.c index 0b3f29195330..0cd216e28f00 100644 --- a/drivers/isdn/mISDN/dsp_hwec.c +++ b/drivers/isdn/mISDN/dsp_hwec.c @@ -51,14 +51,14 @@ void dsp_hwec_enable(struct dsp *dsp, const char *arg) goto _do; { - char *dup, *tok, *name, *val; + char *dup, *next, *tok, *name, *val; int tmp; - dup = kstrdup(arg, GFP_ATOMIC); + dup = next = kstrdup(arg, GFP_ATOMIC); if (!dup) return; - while ((tok = strsep(&dup, ","))) { + while ((tok = strsep(&next, ","))) { if (!strlen(tok)) continue; name = strsep(&tok, "="); |