[PATCH] drivers/hwmon/*: kfree() correct pointers

Alexey Dobriyan · Linus Torvalds · commit 1f57ff89fee4 · 2005-08-26T16:30:30.000-07:00
The adm9240 driver, in adm9240_detect(), allocates a structure.  The
error path attempts to kfree() -&gt;client field of it (second one),
resulting in an oops (or slab corruption) if the hardware is not present.

-&gt;client field in adm1026, adm1031, smsc47b397 and smsc47m1 is the first in
${HWMON}_data structure, but fix them too.

Signed-off-by: Jonathan Corbet &lt;corbet@lwn.net
Signed-off-by: Alexey Dobriyan &lt;adobriyan@gmail.com&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@osdl.org&gt;
diff --git a/drivers/hwmon/adm1026.c b/drivers/hwmon/adm1026.c
@@ -1691,7 +1691,7 @@ int adm1026_detect(struct i2c_adapter *adapter, int address,
 
 	/* Error out and cleanup code */
 exitfree:
-	kfree(new_client);
+	kfree(data);
 exit:
 	return err;
 }
diff --git a/drivers/hwmon/adm1031.c b/drivers/hwmon/adm1031.c
@@ -834,7 +834,7 @@ static int adm1031_detect(struct i2c_adapter *adapter, int address, int kind)
 	return 0;
 
 exit_free:
-	kfree(new_client);
+	kfree(data);
 exit:
 	return err;
 }
diff --git a/drivers/hwmon/adm9240.c b/drivers/hwmon/adm9240.c
@@ -616,7 +616,7 @@ static int adm9240_detect(struct i2c_adapter *adapter, int address, int kind)
 
 	return 0;
 exit_free:
-	kfree(new_client);
+	kfree(data);
 exit:
 	return err;
 }
diff --git a/drivers/hwmon/smsc47b397.c b/drivers/hwmon/smsc47b397.c
@@ -298,7 +298,7 @@ static int smsc47b397_detect(struct i2c_adapter *adapter, int addr, int kind)
 	return 0;
 
 error_free:
-	kfree(new_client);
+	kfree(data);
 error_release:
 	release_region(addr, SMSC_EXTENT);
 	return err;
diff --git a/drivers/hwmon/smsc47m1.c b/drivers/hwmon/smsc47m1.c
@@ -495,7 +495,7 @@ static int smsc47m1_detect(struct i2c_adapter *adapter, int address, int kind)
 	return 0;
 
 error_free:
-	kfree(new_client);
+	kfree(data);
 error_release:
 	release_region(address, SMSC_EXTENT);
 	return err;

Original file line number	Diff line number	Diff line change
`@@ -1691,7 +1691,7 @@ int adm1026_detect(struct i2c_adapter *adapter, int address,`
`1691`	`1691`
`1692`	`1692`	`/* Error out and cleanup code */`
`1693`	`1693`	`exitfree:`
`1694`		`- kfree(new_client);`
	`1694`	`+ kfree(data);`
`1695`	`1695`	`exit:`
`1696`	`1696`	`return err;`
`1697`	`1697`	`}`
Original file line number	Diff line number	Diff line change
`@@ -834,7 +834,7 @@ static int adm1031_detect(struct i2c_adapter *adapter, int address, int kind)`
`834`	`834`	`return 0;`
`835`	`835`
`836`	`836`	`exit_free:`
`837`		`- kfree(new_client);`
	`837`	`+ kfree(data);`
`838`	`838`	`exit:`
`839`	`839`	`return err;`
`840`	`840`	`}`
Original file line number	Diff line number	Diff line change
`@@ -616,7 +616,7 @@ static int adm9240_detect(struct i2c_adapter *adapter, int address, int kind)`
`616`	`616`
`617`	`617`	`return 0;`
`618`	`618`	`exit_free:`
`619`		`- kfree(new_client);`
	`619`	`+ kfree(data);`
`620`	`620`	`exit:`
`621`	`621`	`return err;`
`622`	`622`	`}`