From khali@linux-fr.org Wed Apr 26 14:00:15 2006 Date: Wed, 26 Apr 2006 23:00:16 +0200 From: Jean Delvare To: Greg KH Cc: LM Sensors Subject: scx200_acb: Fix resource name use after free Message-Id: <20060426230016.dca44e58.khali@linux-fr.org> Content-Disposition: inline; filename=i2c-scx200_acb-fix-resource-name-use-after-free.patch We can't pass a string on the stack to request_region. As soon as we leave the function that stack is gone and the string is lost. Let's use the same string we identify the i2c_adapter with instead, it's more simple, more consistent, and just works. This is the second half of fix to bug #6445. Signed-off-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman --- drivers/i2c/busses/scx200_acb.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) --- gregkh-2.6.orig/drivers/i2c/busses/scx200_acb.c +++ gregkh-2.6/drivers/i2c/busses/scx200_acb.c @@ -415,7 +415,6 @@ static int __init scx200_acb_create(con struct scx200_acb_iface *iface; struct i2c_adapter *adapter; int rc; - char description[64]; iface = kzalloc(sizeof(*iface), GFP_KERNEL); if (!iface) { @@ -434,10 +433,7 @@ static int __init scx200_acb_create(con mutex_init(&iface->mutex); - snprintf(description, sizeof(description), "%s ACCESS.bus [%s]", - text, adapter->name); - - if (request_region(base, 8, description) == 0) { + if (!request_region(base, 8, adapter->name)) { printk(KERN_ERR NAME ": can't allocate io 0x%x-0x%x\n", base, base + 8-1); rc = -EBUSY;