Commit:     c9b3febc5b9c55a76b838c977b078195ec8bb95e
Parent:     e804a4a4dd596d853f6d6f814fbdcf97b8efcdea
Author:     Jesper Juhl <[EMAIL PROTECTED]>
AuthorDate: Tue Jul 31 00:39:18 2007 -0700
Committer:  Linus Torvalds <[EMAIL PROTECTED]>
CommitDate: Tue Jul 31 15:39:42 2007 -0700

    Fix a use after free bug in kernel->userspace relay file support
    Coverity spotted what looks like a real possible case of using a variable
    after it has been freed.  The problem is in
    If the code hits "goto free_buf;" it ends up in this code :
                relay_destroy_buf(buf); <--- calls kfree() on 'buf'.
        return buf;             <-- use after free of 'buf'.
    I read through the callers and they all handle a NULL return from this
    function as an error (and hitting the 'free_buf' label only happens on
    failure to chan->cb->create_buf_file(), so that looks like a clear error to
    The patch simply sets 'buf' to NULL after the call to
    relay_destroy_buf(buf); - as far as I can see that should take care of the
    The patch also corrects a reference to a documentation file while
    I was at it.
    Note from Mathieu: the documentation reference change should have been
    done in a separate patch, but I guess no one will really care.
    Signed-off-by: Jesper Juhl <[EMAIL PROTECTED]>
    Acked-by: "David J. Wilder" <[EMAIL PROTECTED]>
    Tested-by: "David J. Wilder" <[EMAIL PROTECTED]>
    Signed-off-by: Mathieu Desnoyers <[EMAIL PROTECTED]>
    Cc: Tom Zanussi <[EMAIL PROTECTED]>
    Cc: Karim Yaghmour <[EMAIL PROTECTED]>
    Signed-off-by: Andrew Morton <[EMAIL PROTECTED]>
    Signed-off-by: Linus Torvalds <[EMAIL PROTECTED]>
 kernel/relay.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/kernel/relay.c b/kernel/relay.c
index 510fbbd..ad85501 100644
--- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -1,7 +1,7 @@
  * Public API and common code for kernel->userspace relay file support.
- * See Documentation/filesystems/relayfs.txt for an overview of relayfs.
+ * See Documentation/filesystems/relay.txt for an overview.
  * Copyright (C) 2002-2005 - Tom Zanussi ([EMAIL PROTECTED]), IBM Corp
  * Copyright (C) 1999-2005 - Karim Yaghmour ([EMAIL PROTECTED])
@@ -426,6 +426,7 @@ static struct rchan_buf *relay_open_buf(struct rchan *chan, 
unsigned int cpu)
+       buf = NULL;
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at

Reply via email to