The patch titled mtd: memory corruption in block2mtd.c has been removed from the -mm tree. Its filename was mtd-memory-corruption-in-block2mtdc.patch This patch was dropped because it was merged into mainline or a subsystem tree The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/ ------------------------------------------------------ Subject: mtd: memory corruption in block2mtd.c From: Ingo van Lil <inguin@xxxxxx> The block2mtd driver (drivers/mtd/devices/block2mtd.c) will kfree an on-stack pointer when handling an invalid argument line (e.g. block2mtd=/dev/loop0,xxx). The kfree was added some time ago when "name" was dynamically allocated. Signed-off-by: Ingo van Lil <inguin@xxxxxx> Acked-by: Joern Engel <joern@xxxxxxxxxxxxxxx> Cc: David Woodhouse <dwmw2@xxxxxxxxxxxxx> Cc: <stable@xxxxxxxxxx> Cc: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- drivers/mtd/devices/block2mtd.c | 1 - 1 file changed, 1 deletion(-) diff -puN drivers/mtd/devices/block2mtd.c~mtd-memory-corruption-in-block2mtdc drivers/mtd/devices/block2mtd.c --- a/drivers/mtd/devices/block2mtd.c~mtd-memory-corruption-in-block2mtdc +++ a/drivers/mtd/devices/block2mtd.c @@ -408,7 +408,6 @@ static int block2mtd_setup2(const char * if (token[1]) { ret = parse_num(&erase_size, token[1]); if (ret) { - kfree(name); parse_err("illegal erase size"); } } _ Patches currently in -mm which might be from inguin@xxxxxx are origin.patch usb-gadget-dummy_hcdc-fix-nested-switch-statements.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html