Messages in this thread | | | Date | Fri, 29 Sep 2006 12:54:57 +0200 | From | Takashi Iwai <> | Subject | Re: [PATCH] Dereference after free in snd_hwdep_release() |
| |
At Thu, 28 Sep 2006 19:45:50 -0400, Florin Malita wrote: > > snd_card_file_remove() may free hw->card so we can't dereference > hw->card->module after that. > > Coverity ID 1420. > > Signed-off-by: Florin Malita <fmalita@gmail.com>
Thanks! Applied to ALSA tree now.
Takashi
> --- > > diff --git a/sound/core/hwdep.c b/sound/core/hwdep.c > index 9aa9d94..46b4768 100644 > --- a/sound/core/hwdep.c > +++ b/sound/core/hwdep.c > @@ -158,6 +158,7 @@ static int snd_hwdep_release(struct inod > { > int err = -ENXIO; > struct snd_hwdep *hw = file->private_data; > + struct module *mod = hw->card->module; > mutex_lock(&hw->open_mutex); > if (hw->ops.release) { > err = hw->ops.release(hw, file); > @@ -167,7 +168,7 @@ static int snd_hwdep_release(struct inod > hw->used--; > snd_card_file_remove(hw->card, file); > mutex_unlock(&hw->open_mutex); > - module_put(hw->card->module); > + module_put(mod); > return err; > } > > > - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |