Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a30450c7 authored by David Woodhouse's avatar David Woodhouse Committed by Matthew Garrett
Browse files

dell-laptop: Fix krealloc() misuse in parse_da_table() 



If krealloc() returns NULL, it *doesn't* free the original. So any code
of the form 'foo = krealloc(foo, …);' is almost certainly a bug.

Signed-off-by: default avatarDavid Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: default avatarMatthew Garrett <matthew.garrett@nebula.com>
parent 77838199

drivers/platform/x86/dell-laptop.c

+6 −4
Original line number Diff line number Diff line
@@ -284,6 +284,7 @@ static void __init parse_da_table(const struct dmi_header *dm) 
{

	/* Final token is a terminator, so we don't want to copy it */

	int tokens = (dm->length-11)/sizeof(struct calling_interface_token)-1;

	struct calling_interface_token *new_da_tokens;

	struct calling_interface_structure *table =

		container_of(dm, struct calling_interface_structure, header);
@@ -296,12 +297,13 @@ static void __init parse_da_table(const struct dmi_header *dm) 
	da_command_address = table->cmdIOAddress;

	da_command_code = table->cmdIOCode;



	da_tokens = krealloc(da_tokens, (da_num_tokens + tokens) *

	new_da_tokens = krealloc(da_tokens, (da_num_tokens + tokens) *

				 sizeof(struct calling_interface_token),

				 GFP_KERNEL);



	if (!da_tokens)

	if (!new_da_tokens)

		return;

	da_tokens = new_da_tokens;



	memcpy(da_tokens+da_num_tokens, table->tokens,

	       sizeof(struct calling_interface_token) * tokens);