From 1f57ff89fee47a317e9e8ca63bf0f139802cc116 Mon Sep 17 00:00:00 2001 From: Alexey Dobriyan Date: Fri, 26 Aug 2005 01:49:14 +0400 Subject: [PATCH] drivers/hwmon/*: kfree() correct pointers The adm9240 driver, in adm9240_detect(), allocates a structure. The error path attempts to kfree() ->client field of it (second one), resulting in an oops (or slab corruption) if the hardware is not present. ->client field in adm1026, adm1031, smsc47b397 and smsc47m1 is the first in ${HWMON}_data structure, but fix them too. Signed-off-by: Jonathan Corbet Signed-off-by: Linus Torvalds --- drivers/hwmon/adm1031.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/hwmon/adm1031.c') diff --git a/drivers/hwmon/adm1031.c b/drivers/hwmon/adm1031.c index 9168e983ca1..4211c8b4601 100644 --- a/drivers/hwmon/adm1031.c +++ b/drivers/hwmon/adm1031.c @@ -834,7 +834,7 @@ static int adm1031_detect(struct i2c_adapter *adapter, int address, int kind) return 0; exit_free: - kfree(new_client); + kfree(data); exit: return err; } -- cgit v1.2.3 From bebf4688e9dbbfdd421736685d607bced91a3c91 Mon Sep 17 00:00:00 2001 From: "Mark M. Hoffman" Date: Fri, 26 Aug 2005 18:34:08 -0700 Subject: [PATCH] I2C hwmon: kfree fixes This patch fixes several instances of hwmon drivers kfree'ing the "wrong" pointer; the existing code works somewhat by accident. (akpm: plucked from Greg's queue based on lkml discussion. Finishes off the patch from Jon Corbet) Signed-off-by: Mark M. Hoffman Signed-off-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- drivers/hwmon/adm1031.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/hwmon/adm1031.c') diff --git a/drivers/hwmon/adm1031.c b/drivers/hwmon/adm1031.c index 4211c8b4601..93625095727 100644 --- a/drivers/hwmon/adm1031.c +++ b/drivers/hwmon/adm1031.c @@ -845,7 +845,7 @@ static int adm1031_detach_client(struct i2c_client *client) if ((ret = i2c_detach_client(client)) != 0) { return ret; } - kfree(client); + kfree(i2c_get_clientdata(client)); return 0; } -- cgit v1.2.3