diff options
| author | Sudeep Holla <sudeep.holla@arm.com> | 2016-05-24 19:12:04 +0300 |
|---|---|---|
| committer | Jassi Brar <jaswinder.singh@linaro.org> | 2016-06-12 12:43:04 +0300 |
| commit | 9ef3c5112139cc5c5666ee096e05bc1e00e94015 (patch) | |
| tree | f81c017fbc254442275eaabbf71676f73ff21b57 /drivers | |
| parent | 8714f8f5fe396ca513ccaaac2304497439c181fb (diff) | |
| download | linux-9ef3c5112139cc5c5666ee096e05bc1e00e94015.tar.xz | |
mailbox: mailbox-test: set tdev->signal to NULL after freeing
tdev->signal is not set NULL after it's freed. This will cause random
exceptions when the stale pointer is accessed after tdev->signal is
freed. Also, since tdev->signal allocation is skipped the next time
it's written, this leads to continuous fault finally leading to the
total death of the system.
Fixes: d1c2f87c9a8f ("mailbox: mailbox-test: Prevent memory leak")
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Acked-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/mailbox/mailbox-test.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/mailbox/mailbox-test.c b/drivers/mailbox/mailbox-test.c index 58d04726cdd7..9ca96e9db6bf 100644 --- a/drivers/mailbox/mailbox-test.c +++ b/drivers/mailbox/mailbox-test.c @@ -133,6 +133,7 @@ static ssize_t mbox_test_message_write(struct file *filp, out: kfree(tdev->signal); kfree(tdev->message); + tdev->signal = NULL; return ret < 0 ? ret : count; } |