diff options
author | Jesper Juhl <jesper.juhl@gmail.com> | 2007-07-31 03:39:18 -0400 |
---|---|---|
committer | Linus Torvalds <torvalds@woody.linux-foundation.org> | 2007-07-31 18:39:42 -0400 |
commit | c9b3febc5b9c55a76b838c977b078195ec8bb95e (patch) | |
tree | 08745cc706021ec1586f8c7541a0218ab1764b08 | |
parent | e804a4a4dd596d853f6d6f814fbdcf97b8efcdea (diff) |
Fix a use after free bug in kernel->userspace relay file support
Coverity spotted what looks like a real possible case of using a variable
after it has been freed. The problem is in
kernel/relay.c::relay_open_buf()
If the code hits "goto free_buf;" it ends up in this code :
free_buf:
relay_destroy_buf(buf); <--- calls kfree() on 'buf'.
free_name:
kfree(tmpname);
end:
return buf; <-- use after free of 'buf'.
I read through the callers and they all handle a NULL return from this
function as an error (and hitting the 'free_buf' label only happens on
failure to chan->cb->create_buf_file(), so that looks like a clear error to
me).
The patch simply sets 'buf' to NULL after the call to
relay_destroy_buf(buf); - as far as I can see that should take care of the
problem.
The patch also corrects a reference to a documentation file while
I was at it.
Note from Mathieu: the documentation reference change should have been
done in a separate patch, but I guess no one will really care.
Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Acked-by: "David J. Wilder" <wilder@us.ibm.com>
Tested-by: "David J. Wilder" <wilder@us.ibm.com>
Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@polymtl.ca>
Cc: Tom Zanussi <zanussi@us.ibm.com>
Cc: Karim Yaghmour <karim@opersys.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-rw-r--r-- | kernel/relay.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/kernel/relay.c b/kernel/relay.c index 510fbbd7b500..ad855017bc59 100644 --- a/kernel/relay.c +++ b/kernel/relay.c | |||
@@ -1,7 +1,7 @@ | |||
1 | /* | 1 | /* |
2 | * Public API and common code for kernel->userspace relay file support. | 2 | * Public API and common code for kernel->userspace relay file support. |
3 | * | 3 | * |
4 | * See Documentation/filesystems/relayfs.txt for an overview of relayfs. | 4 | * See Documentation/filesystems/relay.txt for an overview. |
5 | * | 5 | * |
6 | * Copyright (C) 2002-2005 - Tom Zanussi (zanussi@us.ibm.com), IBM Corp | 6 | * Copyright (C) 2002-2005 - Tom Zanussi (zanussi@us.ibm.com), IBM Corp |
7 | * Copyright (C) 1999-2005 - Karim Yaghmour (karim@opersys.com) | 7 | * Copyright (C) 1999-2005 - Karim Yaghmour (karim@opersys.com) |
@@ -426,6 +426,7 @@ static struct rchan_buf *relay_open_buf(struct rchan *chan, unsigned int cpu) | |||
426 | 426 | ||
427 | free_buf: | 427 | free_buf: |
428 | relay_destroy_buf(buf); | 428 | relay_destroy_buf(buf); |
429 | buf = NULL; | ||
429 | free_name: | 430 | free_name: |
430 | kfree(tmpname); | 431 | kfree(tmpname); |
431 | end: | 432 | end: |