[PATCH] scx200_acb: Fix resource name use after free
Linux Kernel Mailing List <[email protected]> Fri, 2 Jun 2006 18:59:50 GMT
| Newsgroups | gmane.linux.kernel.commits.2-4 |
|---|---|
| Message-ID | <[email protected]> |
commit 252a7a8238d91aa4067934798c33d2aa63f84fd8 tree 21852a0c4846830e73a97402697ce8e71a6d9f80 parent 02099adcd5e288be5237d932f5b34296dcebfb3d author Jean Delvare <[email protected]> Wed, 31 May 2006 17:16:16 +0200 committer Marcelo Tosatti <[email protected]> Fri, 02 Jun 2006 21:28:39 -0300 [PATCH] scx200_acb: Fix resource name use after free scx200_acb: Fix resource name use after free We can't pass a string on the stack to request_region. As soon as we leave the function that stack is gone and the string is lost. Let's use the same string we identify the i2c_adapter with instead, it's more simple, more consistent, and just works. This is the second half of fix to bug #6445. It was merged in 2.6.17-rc4: http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b33d0798e6cfae1fcee75afc808fe5690a48a814 And 2.6.16.17: http://www.kernel.org/git/?p=linux/kernel/git/stable/linux-2.6.16.y.git;a=commit;h=9a4a3539b356a8f4da8c6ace95bc4135314fed7e Signed-off-by: Jean Delvare <[email protected]> drivers/i2c/scx200_acb.c | 4 +--- 1 files changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/i2c/scx200_acb.c b/drivers/i2c/scx200_acb.c index 6d1824b..677186b 100644 --- a/drivers/i2c/scx200_acb.c +++ b/drivers/i2c/scx200_acb.c @@ -467,7 +467,6 @@ static int __init scx200_acb_create(int struct scx200_acb_iface *iface; struct i2c_adapter *adapter; int rc = 0; - char description[64]; iface = kmalloc(sizeof(*iface), GFP_KERNEL); if (!iface) { @@ -489,8 +488,7 @@ static int __init scx200_acb_create(int init_MUTEX(&iface->sem); - sprintf(description, "NatSemi SCx200 ACCESS.bus [%s]", adapter->name); - if (request_region(base, 8, description) == 0) { + if (request_region(base, 8, adapter->name) == 0) { printk(KERN_ERR NAME ": %s, can't allocate io 0x%x-0x%x\n", adapter->name, base, base + 8-1); rc = -EBUSY;