Gitweb:     
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=c9b3febc5b9c55a76b838c977b078195ec8bb95e
Commit:     c9b3febc5b9c55a76b838c977b078195ec8bb95e
Parent:     e804a4a4dd596d853f6d6f814fbdcf97b8efcdea
Author:     Jesper Juhl <[EMAIL PROTECTED]>
AuthorDate: Tue Jul 31 00:39:18 2007 -0700
Committer:  Linus Torvalds <[EMAIL PROTECTED]>
CommitDate: Tue Jul 31 15:39:42 2007 -0700

    Fix a use after free bug in kernel->userspace relay file support
    
    Coverity spotted what looks like a real possible case of using a variable
    after it has been freed.  The problem is in
    kernel/relay.c::relay_open_buf()
    
    If the code hits "goto free_buf;" it ends up in this code :
    
      free_buf:
                relay_destroy_buf(buf); <--- calls kfree() on 'buf'.
      free_name:
        kfree(tmpname);
      end:
        return buf;             <-- use after free of 'buf'.
    
    I read through the callers and they all handle a NULL return from this
    function as an error (and hitting the 'free_buf' label only happens on
    failure to chan->cb->create_buf_file(), so that looks like a clear error to
    me).
    
    The patch simply sets 'buf' to NULL after the call to
    relay_destroy_buf(buf); - as far as I can see that should take care of the
    problem.
    
    The patch also corrects a reference to a documentation file while
    I was at it.
    
    Note from Mathieu: the documentation reference change should have been
    done in a separate patch, but I guess no one will really care.
    
    Signed-off-by: Jesper Juhl <[EMAIL PROTECTED]>
    Acked-by: "David J. Wilder" <[EMAIL PROTECTED]>
    Tested-by: "David J. Wilder" <[EMAIL PROTECTED]>
    Signed-off-by: Mathieu Desnoyers <[EMAIL PROTECTED]>
    Cc: Tom Zanussi <[EMAIL PROTECTED]>
    Cc: Karim Yaghmour <[EMAIL PROTECTED]>
    Signed-off-by: Andrew Morton <[EMAIL PROTECTED]>
    Signed-off-by: Linus Torvalds <[EMAIL PROTECTED]>
---
 kernel/relay.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/kernel/relay.c b/kernel/relay.c
index 510fbbd..ad85501 100644
--- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -1,7 +1,7 @@
 /*
  * Public API and common code for kernel->userspace relay file support.
  *
- * See Documentation/filesystems/relayfs.txt for an overview of relayfs.
+ * See Documentation/filesystems/relay.txt for an overview.
  *
  * Copyright (C) 2002-2005 - Tom Zanussi ([EMAIL PROTECTED]), IBM Corp
  * Copyright (C) 1999-2005 - Karim Yaghmour ([EMAIL PROTECTED])
@@ -426,6 +426,7 @@ static struct rchan_buf *relay_open_buf(struct rchan *chan, 
unsigned int cpu)
 
 free_buf:
        relay_destroy_buf(buf);
+       buf = NULL;
 free_name:
        kfree(tmpname);
 end:
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to