summaryrefslogtreecommitdiff
path: root/drivers/platform
diff options
context:
space:
mode:
authorDavid Woodhouse <dwmw2@infradead.org>2013-03-14 17:33:15 +0400
committerMatthew Garrett <matthew.garrett@nebula.com>2013-05-09 03:59:44 +0400
commita30450c7bbb04212c5f01936274ca8d965cabf79 (patch)
tree24b59002cc5a75f4177297d9a4d5f73cfbca81c2 /drivers/platform
parent7783819920ca52fc582a2782f654fe6ed373f465 (diff)
downloadlinux-a30450c7bbb04212c5f01936274ca8d965cabf79.tar.xz
dell-laptop: Fix krealloc() misuse in parse_da_table()
If krealloc() returns NULL, it *doesn't* free the original. So any code of the form 'foo = krealloc(foo, …);' is almost certainly a bug. Signed-off-by: David Woodhouse <David.Woodhouse@intel.com> Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
Diffstat (limited to 'drivers/platform')
-rw-r--r--drivers/platform/x86/dell-laptop.c10
1 files changed, 6 insertions, 4 deletions
diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
index fa3ee6209572..1134119521ac 100644
--- a/drivers/platform/x86/dell-laptop.c
+++ b/drivers/platform/x86/dell-laptop.c
@@ -284,6 +284,7 @@ static void __init parse_da_table(const struct dmi_header *dm)
{
/* Final token is a terminator, so we don't want to copy it */
int tokens = (dm->length-11)/sizeof(struct calling_interface_token)-1;
+ struct calling_interface_token *new_da_tokens;
struct calling_interface_structure *table =
container_of(dm, struct calling_interface_structure, header);
@@ -296,12 +297,13 @@ static void __init parse_da_table(const struct dmi_header *dm)
da_command_address = table->cmdIOAddress;
da_command_code = table->cmdIOCode;
- da_tokens = krealloc(da_tokens, (da_num_tokens + tokens) *
- sizeof(struct calling_interface_token),
- GFP_KERNEL);
+ new_da_tokens = krealloc(da_tokens, (da_num_tokens + tokens) *
+ sizeof(struct calling_interface_token),
+ GFP_KERNEL);
- if (!da_tokens)
+ if (!new_da_tokens)
return;
+ da_tokens = new_da_tokens;
memcpy(da_tokens+da_num_tokens, table->tokens,
sizeof(struct calling_interface_token) * tokens);