probe_thermostat() allocates the thermostat state before creating the monitoring kthread. If kthread_run() fails with -ENOMEM, the function returns immediately without freeing the allocated state. Since probe fails, remove_thermostat() will not be called, so the allocation is leaked. Free the thermostat state before returning from the kthread creation failure path. This issue was found by manual code inspection. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li --- drivers/macintosh/therm_adt746x.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/macintosh/therm_adt746x.c b/drivers/macintosh/therm_adt746x.c index 1ac29a5cd324..60f292a5aa3b 100644 --- a/drivers/macintosh/therm_adt746x.c +++ b/drivers/macintosh/therm_adt746x.c @@ -557,6 +557,7 @@ static int probe_thermostat(struct i2c_client *client) if (th->thread == ERR_PTR(-ENOMEM)) { printk(KERN_INFO "adt746x: Kthread creation failed\n"); th->thread = NULL; + kfree(th); return -ENOMEM; } -- 2.43.0