diff options
| author | Alexey Khoroshilov <khoroshilov@ispras.ru> | 2022-03-04 21:25:36 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2022-03-05 12:04:14 +0000 |
| commit | c6a502c2299941c8326d029cfc8a3bc8a4607ad5 (patch) | |
| tree | ceac43f3f5a0351f3724fb8960e6765de19647c9 /drivers/isdn/mISDN | |
| parent | a502a8f04097e038c3daa16c5202a9538116d563 (diff) | |
| download | linux-stable-c6a502c2299941c8326d029cfc8a3bc8a4607ad5.tar.gz linux-stable-c6a502c2299941c8326d029cfc8a3bc8a4607ad5.tar.bz2 linux-stable-c6a502c2299941c8326d029cfc8a3bc8a4607ad5.zip | |
mISDN: Fix memory leak in dsp_pipeline_build()
dsp_pipeline_build() allocates dup pointer by kstrdup(cfg),
but then it updates dup variable by strsep(&dup, "|").
As a result when it calls kfree(dup), the dup variable contains NULL.
Found by Linux Driver Verification project (linuxtesting.org) with SVACE.
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Fixes: 960366cf8dbb ("Add mISDN DSP")
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/isdn/mISDN')
| -rw-r--r-- | drivers/isdn/mISDN/dsp_pipeline.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/isdn/mISDN/dsp_pipeline.c b/drivers/isdn/mISDN/dsp_pipeline.c index e11ca6bbc7f4..c3b2c99b5cd5 100644 --- a/drivers/isdn/mISDN/dsp_pipeline.c +++ b/drivers/isdn/mISDN/dsp_pipeline.c @@ -192,7 +192,7 @@ void dsp_pipeline_destroy(struct dsp_pipeline *pipeline) int dsp_pipeline_build(struct dsp_pipeline *pipeline, const char *cfg) { int found = 0; - char *dup, *tok, *name, *args; + char *dup, *next, *tok, *name, *args; struct dsp_element_entry *entry, *n; struct dsp_pipeline_entry *pipeline_entry; struct mISDN_dsp_element *elem; @@ -203,10 +203,10 @@ int dsp_pipeline_build(struct dsp_pipeline *pipeline, const char *cfg) if (!list_empty(&pipeline->list)) _dsp_pipeline_destroy(pipeline); - dup = kstrdup(cfg, GFP_ATOMIC); + dup = next = kstrdup(cfg, GFP_ATOMIC); if (!dup) return 0; - while ((tok = strsep(&dup, "|"))) { + while ((tok = strsep(&next, "|"))) { if (!strlen(tok)) continue; name = strsep(&tok, "("); |