Commit c6a502c2 authored by Alexey Khoroshilov's avatar Alexey Khoroshilov Committed by David S. Miller
Browse files

mISDN: Fix memory leak in dsp_pipeline_build() 



dsp_pipeline_build() allocates dup pointer by kstrdup(cfg),
but then it updates dup variable by strsep(&dup, "|").
As a result when it calls kfree(dup), the dup variable contains NULL.

Found by Linux Driver Verification project (linuxtesting.org) with SVACE.

Signed-off-by: default avatarAlexey Khoroshilov <khoroshilov@ispras.ru>
Fixes: 960366cf ("Add mISDN DSP")
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent a502a8f0

drivers/isdn/mISDN/dsp_pipeline.c

+3 −3
Original line number Diff line number Diff line
@@ -192,7 +192,7 @@ void dsp_pipeline_destroy(struct dsp_pipeline *pipeline) 
int dsp_pipeline_build(struct dsp_pipeline *pipeline, const char *cfg)

{

	int found = 0;

	char *dup, *tok, *name, *args;

	char *dup, *next, *tok, *name, *args;

	struct dsp_element_entry *entry, *n;

	struct dsp_pipeline_entry *pipeline_entry;

	struct mISDN_dsp_element *elem;
@@ -203,10 +203,10 @@ int dsp_pipeline_build(struct dsp_pipeline *pipeline, const char *cfg) 
	if (!list_empty(&pipeline->list))

		_dsp_pipeline_destroy(pipeline);



	dup = kstrdup(cfg, GFP_ATOMIC);

	dup = next = kstrdup(cfg, GFP_ATOMIC);

	if (!dup)

		return 0;

	while ((tok = strsep(&dup, "|"))) {

	while ((tok = strsep(&next, "|"))) {

		if (!strlen(tok))

			continue;

		name = strsep(&tok, "(");