diff options
author | Jean Delvare <khali@linux-fr.org> | 2006-04-26 17:00:16 -0400 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@suse.de> | 2006-05-09 16:04:21 -0400 |
commit | b33d0798e6cfae1fcee75afc808fe5690a48a814 (patch) | |
tree | fee80034c1633f195c1f32493063208abde7d5ca /drivers/i2c | |
parent | 6f9c2963888e60e46a9e0bd09a25740abce29262 (diff) |
[PATCH] scx200_acb: Fix resource name use after free
We can't pass a string on the stack to request_region. As soon as we
leave the function that stack is gone and the string is lost. Let's
use the same string we identify the i2c_adapter with instead, it's
more simple, more consistent, and just works.
This is the second half of fix to bug #6445.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/i2c')
-rw-r--r-- | drivers/i2c/busses/scx200_acb.c | 6 |
1 files changed, 1 insertions, 5 deletions
diff --git a/drivers/i2c/busses/scx200_acb.c b/drivers/i2c/busses/scx200_acb.c index f2dae6831142..42e4e00d6c32 100644 --- a/drivers/i2c/busses/scx200_acb.c +++ b/drivers/i2c/busses/scx200_acb.c | |||
@@ -415,7 +415,6 @@ static int __init scx200_acb_create(const char *text, int base, int index) | |||
415 | struct scx200_acb_iface *iface; | 415 | struct scx200_acb_iface *iface; |
416 | struct i2c_adapter *adapter; | 416 | struct i2c_adapter *adapter; |
417 | int rc; | 417 | int rc; |
418 | char description[64]; | ||
419 | 418 | ||
420 | iface = kzalloc(sizeof(*iface), GFP_KERNEL); | 419 | iface = kzalloc(sizeof(*iface), GFP_KERNEL); |
421 | if (!iface) { | 420 | if (!iface) { |
@@ -434,10 +433,7 @@ static int __init scx200_acb_create(const char *text, int base, int index) | |||
434 | 433 | ||
435 | mutex_init(&iface->mutex); | 434 | mutex_init(&iface->mutex); |
436 | 435 | ||
437 | snprintf(description, sizeof(description), "%s ACCESS.bus [%s]", | 436 | if (!request_region(base, 8, adapter->name)) { |
438 | text, adapter->name); | ||
439 | |||
440 | if (request_region(base, 8, description) == 0) { | ||
441 | printk(KERN_ERR NAME ": can't allocate io 0x%x-0x%x\n", | 437 | printk(KERN_ERR NAME ": can't allocate io 0x%x-0x%x\n", |
442 | base, base + 8-1); | 438 | base, base + 8-1); |
443 | rc = -EBUSY; | 439 | rc = -EBUSY; |