[Patch] Zarlink zl10036 DVB-S: Fix mem leak in zl10036_attach

[Jesper Juhl]

If the memory allocation to 'state' succeeds but we jump to the 'error' 
label before 'state' is assigned to fe->tuner_priv, then the call to 
'zl10036_release(fe)' at the 'error:' label will not free 'state', but 
only what was previously assigned to 'tuner_priv', thus leaking the memory 
allocated to 'state'.
There are may ways to fix this, including assigning the allocated memory 
directly to 'fe->tuner_priv', but I did not go for that since the 
additional pointer derefs are more expensive than the local variable, so I 
just added a 'kfree(state)' call. I guess the call to 'zl10036_release' 
might not even be needed in this case, but I wasn't sure, so I left it in.

Signed-off-by: Jesper Juhl <jj@xxxxxxxxxxxxx>
---
 zl10036.c |    1 +
 1 file changed, 1 insertion(+)

 compile tested only.

diff --git a/drivers/media/dvb/frontends/zl10036.c b/drivers/media/dvb/frontends/zl10036.c
index 4627f49..b4fb8e8 100644
--- a/drivers/media/dvb/frontends/zl10036.c
+++ b/drivers/media/dvb/frontends/zl10036.c
@@ -508,6 +508,7 @@ struct dvb_frontend *zl10036_attach(struct dvb_frontend *fe,
 
 error:
 	zl10036_release(fe);
+	kfree(state);
 	return NULL;
 }
 EXPORT_SYMBOL(zl10036_attach);


-- 
Jesper Juhl <jj@xxxxxxxxxxxxx>            http://www.chaosbits.net/
Plain text mails only, please.
Don't top-post http://www.catb.org/~esr/jargon/html/T/top-post.html

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/