From: Jesper Juhl Date: Tue, 31 Jul 2007 07:39:18 +0000 (-0700) Subject: Fix a use after free bug in kernel->userspace relay file support X-Git-Tag: v2.6.23-rc2~54 X-Git-Url: http://pilppa.com/gitweb/?a=commitdiff_plain;h=c9b3febc5b9c55a76b838c977b078195ec8bb95e;p=linux-2.6-omap-h63xx.git Fix a use after free bug in kernel->userspace relay file support Coverity spotted what looks like a real possible case of using a variable after it has been freed. The problem is in kernel/relay.c::relay_open_buf() If the code hits "goto free_buf;" it ends up in this code : free_buf: relay_destroy_buf(buf); <--- calls kfree() on 'buf'. free_name: kfree(tmpname); end: return buf; <-- use after free of 'buf'. I read through the callers and they all handle a NULL return from this function as an error (and hitting the 'free_buf' label only happens on failure to chan->cb->create_buf_file(), so that looks like a clear error to me). The patch simply sets 'buf' to NULL after the call to relay_destroy_buf(buf); - as far as I can see that should take care of the problem. The patch also corrects a reference to a documentation file while I was at it. Note from Mathieu: the documentation reference change should have been done in a separate patch, but I guess no one will really care. Signed-off-by: Jesper Juhl Acked-by: "David J. Wilder" Tested-by: "David J. Wilder" Signed-off-by: Mathieu Desnoyers Cc: Tom Zanussi Cc: Karim Yaghmour Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- diff --git a/kernel/relay.c b/kernel/relay.c index 510fbbd7b50..ad855017bc5 100644 --- a/kernel/relay.c +++ b/kernel/relay.c @@ -1,7 +1,7 @@ /* * Public API and common code for kernel->userspace relay file support. * - * See Documentation/filesystems/relayfs.txt for an overview of relayfs. + * See Documentation/filesystems/relay.txt for an overview. * * Copyright (C) 2002-2005 - Tom Zanussi (zanussi@us.ibm.com), IBM Corp * Copyright (C) 1999-2005 - Karim Yaghmour (karim@opersys.com) @@ -426,6 +426,7 @@ static struct rchan_buf *relay_open_buf(struct rchan *chan, unsigned int cpu) free_buf: relay_destroy_buf(buf); + buf = NULL; free_name: kfree(tmpname); end: