aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJesper Juhl <jesper.juhl@gmail.com>2007-07-31 03:39:18 -0400
committerLinus Torvalds <torvalds@woody.linux-foundation.org>2007-07-31 18:39:42 -0400
commitc9b3febc5b9c55a76b838c977b078195ec8bb95e (patch)
tree08745cc706021ec1586f8c7541a0218ab1764b08
parente804a4a4dd596d853f6d6f814fbdcf97b8efcdea (diff)
Fix a use after free bug in kernel->userspace relay file support
Coverity spotted what looks like a real possible case of using a variable after it has been freed. The problem is in kernel/relay.c::relay_open_buf() If the code hits "goto free_buf;" it ends up in this code : free_buf: relay_destroy_buf(buf); <--- calls kfree() on 'buf'. free_name: kfree(tmpname); end: return buf; <-- use after free of 'buf'. I read through the callers and they all handle a NULL return from this function as an error (and hitting the 'free_buf' label only happens on failure to chan->cb->create_buf_file(), so that looks like a clear error to me). The patch simply sets 'buf' to NULL after the call to relay_destroy_buf(buf); - as far as I can see that should take care of the problem. The patch also corrects a reference to a documentation file while I was at it. Note from Mathieu: the documentation reference change should have been done in a separate patch, but I guess no one will really care. Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com> Acked-by: "David J. Wilder" <wilder@us.ibm.com> Tested-by: "David J. Wilder" <wilder@us.ibm.com> Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@polymtl.ca> Cc: Tom Zanussi <zanussi@us.ibm.com> Cc: Karim Yaghmour <karim@opersys.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-rw-r--r--kernel/relay.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/kernel/relay.c b/kernel/relay.c
index 510fbbd7b500..ad855017bc59 100644
--- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -1,7 +1,7 @@
1/* 1/*
2 * Public API and common code for kernel->userspace relay file support. 2 * Public API and common code for kernel->userspace relay file support.
3 * 3 *
4 * See Documentation/filesystems/relayfs.txt for an overview of relayfs. 4 * See Documentation/filesystems/relay.txt for an overview.
5 * 5 *
6 * Copyright (C) 2002-2005 - Tom Zanussi (zanussi@us.ibm.com), IBM Corp 6 * Copyright (C) 2002-2005 - Tom Zanussi (zanussi@us.ibm.com), IBM Corp
7 * Copyright (C) 1999-2005 - Karim Yaghmour (karim@opersys.com) 7 * Copyright (C) 1999-2005 - Karim Yaghmour (karim@opersys.com)
@@ -426,6 +426,7 @@ static struct rchan_buf *relay_open_buf(struct rchan *chan, unsigned int cpu)
426 426
427free_buf: 427free_buf:
428 relay_destroy_buf(buf); 428 relay_destroy_buf(buf);
429 buf = NULL;
429free_name: 430free_name:
430 kfree(tmpname); 431 kfree(tmpname);
431end: 432end: