lkml.org 
[lkml]   [2006]   [Apr]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Subject[Patch] use after free in drivers/media/video/em28xx/em28xx-video.c
From
Date
hi,

in several we use dev->devno right after we kfree()
dev. This fixes coverity bug id #1065

Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>

--- linux-2.6.17-rc1/drivers/media/video/em28xx/em28xx-video.c.orig 2006-04-10 23:49:05.000000000 +0200
+++ linux-2.6.17-rc1/drivers/media/video/em28xx/em28xx-video.c 2006-04-10 23:50:05.000000000 +0200
@@ -1576,8 +1576,8 @@ static int em28xx_init_dev(struct em28xx
errCode = em28xx_config(dev);
if (errCode) {
em28xx_errdev("error configuring device\n");
- kfree(dev);
em28xx_devused&=~(1<<dev->devno);
+ kfree(dev);
return -ENOMEM;
}

@@ -1603,8 +1603,8 @@ static int em28xx_init_dev(struct em28xx
dev->vdev = video_device_alloc();
if (NULL == dev->vdev) {
em28xx_errdev("cannot allocate video_device.\n");
- kfree(dev);
em28xx_devused&=~(1<<dev->devno);
+ kfree(dev);
return -ENOMEM;
}

@@ -1612,8 +1612,8 @@ static int em28xx_init_dev(struct em28xx
if (NULL == dev->vbi_dev) {
em28xx_errdev("cannot allocate video_device.\n");
kfree(dev->vdev);
- kfree(dev);
em28xx_devused&=~(1<<dev->devno);
+ kfree(dev);
return -ENOMEM;
}

@@ -1650,8 +1650,8 @@ static int em28xx_init_dev(struct em28xx
mutex_unlock(&dev->lock);
list_del(&dev->devlist);
video_device_release(dev->vdev);
- kfree(dev);
em28xx_devused&=~(1<<dev->devno);
+ kfree(dev);
return -ENODEV;
}

@@ -1662,8 +1662,8 @@ static int em28xx_init_dev(struct em28xx
list_del(&dev->devlist);
video_device_release(dev->vbi_dev);
video_device_release(dev->vdev);
- kfree(dev);
em28xx_devused&=~(1<<dev->devno);
+ kfree(dev);
return -ENODEV;
} else {
printk("registered VBI\n");

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2006-04-11 00:01    [W:0.046 / U:0.068 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site