[PATCH 4/4] drivers/media/video: Eliminate use after free
in [Kernel]
|
Prev: [PATCH 2/4] drivers/scsi/aacraid: Eliminate use after free
Next: [PATCH 1/4] drivers/char: Eliminate use after free
From: Julia Lawall on 15 May 2010 05:50 From: Julia Lawall <julia(a)diku.dk> The error value is saved in a new local variable err before freeing the containing structure. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> @free@ expression E; position p; @@ kfree@p(E) @@ expression free.E, subE<=free.E, E1; position free.p; @@ kfree@p(E) ... ( subE = E1 | * E ) // </smpl> Signed-off-by: Julia Lawall <julia(a)diku.dk> --- drivers/media/video/mem2mem_testdev.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/media/video/mem2mem_testdev.c b/drivers/media/video/mem2mem_testdev.c index baf211b..fb73f34 100644 --- a/drivers/media/video/mem2mem_testdev.c +++ b/drivers/media/video/mem2mem_testdev.c @@ -858,6 +858,7 @@ static int m2mtest_open(struct file *file) { struct m2mtest_dev *dev = video_drvdata(file); struct m2mtest_ctx *ctx = NULL; + int err; ctx = kzalloc(sizeof *ctx, GFP_KERNEL); if (!ctx) @@ -871,8 +872,9 @@ static int m2mtest_open(struct file *file) ctx->m2m_ctx = v4l2_m2m_ctx_init(ctx, dev->m2m_dev, queue_init); if (IS_ERR(ctx->m2m_ctx)) { + err = PTR_ERR(ctx->m2m_ctx); kfree(ctx); - return PTR_ERR(ctx->m2m_ctx); + return err; } atomic_inc(&dev->num_inst); -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo(a)vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/ |