Author: Jesper Juhl <[EMAIL PROTECTED]>
AuthorDate: Tue Jul 31 00:39:18 2007 -0700
Committer: Linus Torvalds <[EMAIL PROTECTED]>
CommitDate: Tue Jul 31 15:39:42 2007 -0700
Fix a use after free bug in kernel->userspace relay file support
Coverity spotted what looks like a real possible case of using a variable
after it has been freed. The problem is in
If the code hits "goto free_buf;" it ends up in this code :
relay_destroy_buf(buf); <--- calls kfree() on 'buf'.
return buf; <-- use after free of 'buf'.
I read through the callers and they all handle a NULL return from this
function as an error (and hitting the 'free_buf' label only happens on
failure to chan->cb->create_buf_file(), so that looks like a clear error to
The patch simply sets 'buf' to NULL after the call to
relay_destroy_buf(buf); - as far as I can see that should take care of the
The patch also corrects a reference to a documentation file while
I was at it.
Note from Mathieu: the documentation reference change should have been
done in a separate patch, but I guess no one will really care.
Signed-off-by: Jesper Juhl <[EMAIL PROTECTED]>
Acked-by: "David J. Wilder" <[EMAIL PROTECTED]>
Tested-by: "David J. Wilder" <[EMAIL PROTECTED]>
Signed-off-by: Mathieu Desnoyers <[EMAIL PROTECTED]>
Cc: Tom Zanussi <[EMAIL PROTECTED]>
Cc: Karim Yaghmour <[EMAIL PROTECTED]>
Signed-off-by: Andrew Morton <[EMAIL PROTECTED]>
Signed-off-by: Linus Torvalds <[EMAIL PROTECTED]>
kernel/relay.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/kernel/relay.c b/kernel/relay.c
index 510fbbd..ad85501 100644
@@ -1,7 +1,7 @@
* Public API and common code for kernel->userspace relay file support.
- * See Documentation/filesystems/relayfs.txt for an overview of relayfs.
+ * See Documentation/filesystems/relay.txt for an overview.
* Copyright (C) 2002-2005 - Tom Zanussi ([EMAIL PROTECTED]), IBM Corp
* Copyright (C) 1999-2005 - Karim Yaghmour ([EMAIL PROTECTED])
@@ -426,6 +426,7 @@ static struct rchan_buf *relay_open_buf(struct rchan *chan,
unsigned int cpu)
+ buf = NULL;
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html