From 23aa2ad4a6281a43a3836bfeac006d03a4a361a0 Mon Sep 17 00:00:00 2001 From: Mark Hounschell Date: Wed, 23 Apr 2014 10:33:45 -0400 Subject: [PATCH] staging: dgap: Fix BUG in processing config file This patch fixes an OOPS caused by a pointer being changed between the malloc and free. Signed-off-by: Mark Hounschell Tested-by: Mark Hounschell Reported-by: Mark Hounschell Signed-off-by: Greg Kroah-Hartman --- drivers/staging/dgap/dgap.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/staging/dgap/dgap.c b/drivers/staging/dgap/dgap.c index e0b8d0f051cc..55a23b051e86 100644 --- a/drivers/staging/dgap/dgap.c +++ b/drivers/staging/dgap/dgap.c @@ -820,6 +820,7 @@ static int dgap_firmware_load(struct pci_dev *pdev, int card_type) { struct board_t *brd = dgap_Board[dgap_NumBoards - 1]; const struct firmware *fw; + char *tmp_ptr; int ret; dgap_get_vpd(brd); @@ -843,7 +844,14 @@ static int dgap_firmware_load(struct pci_dev *pdev, int card_type) memcpy(dgap_config_buf, fw->data, fw->size); release_firmware(fw); - if (dgap_parsefile(&dgap_config_buf, TRUE) != 0) { + /* + * preserve dgap_config_buf + * as dgap_parsefile would + * otherwise alter it. + */ + tmp_ptr = dgap_config_buf; + + if (dgap_parsefile(&tmp_ptr, TRUE) != 0) { kfree(dgap_config_buf); return -EINVAL; }