The patch titled Subject: drivers/input/evdev.c: don't kfree() a vmalloc address has been added to the -mm tree. Its filename is drivers-input-evdevc-dont-kfree-a-vmalloc-address.patch This patch should soon appear at http://ozlabs.org/~akpm/mmots/broken-out/drivers-input-evdevc-dont-kfree-a-vmalloc-address.patch echo and later at echo http://ozlabs.org/~akpm/mmotm/broken-out/drivers-input-evdevc-dont-kfree-a-vmalloc-address.patch Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/SubmitChecklist when testing your code *** The -mm tree is included into linux-next and is updated there every 3-4 working days ------------------------------------------------------ From: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> Subject: drivers/input/evdev.c: don't kfree() a vmalloc address If kzalloc() failed and then evdev_open_device() fails, evdev_open() will pass a vmalloc'ed pointer to kfree. This might fix https://bugzilla.kernel.org/show_bug.cgi?id=88401, where there was a crash in vfree(). Reported-by: Christian Casteyde <casteyde.christian@xxxxxxx> Cc: Dmitry Torokhov <dmitry.torokhov@xxxxxxxxx> Cc: Henrik Rydberg <rydberg@xxxxxxxxxxx> Cc: <stable@xxxxxxxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- drivers/input/evdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff -puN drivers/input/evdev.c~drivers-input-evdevc-dont-kfree-a-vmalloc-address drivers/input/evdev.c --- a/drivers/input/evdev.c~drivers-input-evdevc-dont-kfree-a-vmalloc-address +++ a/drivers/input/evdev.c @@ -421,7 +421,7 @@ static int evdev_open(struct inode *inod err_free_client: evdev_detach_client(evdev, client); - kfree(client); + kvfree(client); return error; } _ Patches currently in -mm which might be from akpm@xxxxxxxxxxxxxxxxxxxx are i-need-old-gcc.patch arch-alpha-kernel-systblss-remove-debug-check.patch mm-vmpressurec-fix-race-in-vmpressure_work_fn.patch mm-vmpressurec-fix-race-in-vmpressure_work_fn-fix.patch drivers-input-evdevc-dont-kfree-a-vmalloc-address.patch input-route-kbd-leds-through-the-generic-leds-layer.patch o2dlm-fix-null-pointer-dereference-in-o2dlm_blocking_ast_wrapper-checkpatch-fixes.patch ocfs2-free-inode-when-i_count-becomes-zero.patch ocfs2-add-functions-to-add-and-remove-inode-in-orphan-dir-fix.patch mm.patch slab-improve-checking-for-invalid-gfp_flags.patch mm-memcontrol-lockless-page-counters-fix.patch mm-memcontrol-lockless-page-counters-fix-fix.patch kernel-res_counter-remove-the-unused-api-fix.patch mm-compaction-simplify-deferred-compaction-fix.patch mm-compaction-always-update-cached-scanner-positions-fix-checkpatch-fixes.patch mm-memcontrol-remove-unnecessary-pcg_used-pc-mem_cgroup-valid-flag-fix.patch mm-memcontrol-fold-mem_cgroup_start_move-mem_cgroup_end_move-fix.patch mm-fix-huge-zero-page-accounting-in-smaps-report-fix-2-fix.patch mm-page_allocc-__alloc_pages_nodemask-dont-alter-arg-gfp_mask.patch mm-mincore-add-hwpoison-page-handle-checkpatch-fixes.patch mm-page_alloc-store-updated-page-migratetype-to-avoid-misusing-stale-value-fix.patch mm-introduce-do_shared_fault-and-drop-do_fault-fix-fix.patch zsmalloc-fix-zs_init-cpu-notifier-error-handling-fix-2.patch zsmalloc-fix-zs_init-cpu-notifier-error-handling-fix.patch do_shared_fault-check-that-mmap_sem-is-held.patch fs-proc-use-a-rb-tree-for-the-directory-entries-fix.patch fs-binfmt_miscc-use-gfp_kernel-instead-of-gfp_user.patch init-allow-config_init_fallback=n-to-disable-defaults-if-init=-fails-checkpatch-fixes.patch rtc-omap-add-support-for-pmic_power_en-v3-fix.patch drivers-rtc-rtc-sirfsocc-add-alarm_irq_enable-support-fix.patch exit-wait-cleanup-the-ptrace_reparented-checks-fix.patch sysctl-terminate-strings-also-on-r-fix.patch ipc-semc-chance-memory-barrier-in-sem_lock-to-smp_rmb-fix.patch ipc-semc-chance-memory-barrier-in-sem_lock-to-smp_rmb-fix-fix.patch ipc-msg-increase-msgmni-remove-scaling-checkpatch-fixes.patch linux-next.patch linux-next-rejects.patch drivers-gpio-gpio-zevioc-fix-build.patch mm-cma-make-kmemleak-ignore-cma-regions.patch lib-show_mem-this-patch-adds-cma-reserved-infromation-fix.patch tools-testing-selftests-makefile-alphasort-the-targets-list.patch mm-replace-remap_file_pages-syscall-with-emulation.patch debugging-keep-track-of-page-owners.patch debugging-keep-track-of-page-owners-fix.patch journal_add_journal_head-debug.patch journal_add_journal_head-debug-fix.patch kernel-forkc-export-kernel_thread-to-modules.patch mutex-subsystem-synchro-test-module.patch slab-leaks3-default-y.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html