Messages in this thread | | | Date | Tue, 24 Mar 2009 15:29:17 +0300 | Subject | Dereferencing freed memory bugs | From | Dan Carpenter <> |
| |
I added a check to smatch (http://repo.or.cz/w/smatch.git/) to check for when we dereference freed memory.
drivers/dma/dmatest.c +410 dmatest_exit(7) 'dtc' drivers/dma/dmatest.c +412 dmatest_exit(9) 'dtc' drivers/infiniband/hw/nes/nes_cm.c +563 nes_cm_timer_tick(121) 'cm_node' drivers/infiniband/hw/nes/nes_cm.c +621 nes_cm_timer_tick(179) 'cm_node' drivers/scsi/dpt_i2o.c +246 adpt_detect(58) 'pHba' drivers/scsi/dpt_i2o.c +266 adpt_detect(78) 'pHba' drivers/scsi/dpt_i2o.c +1236 adpt_i2o_delete_hba(78) 'pHba' drivers/usb/host/ehci-hcd.c +1661 itd_complete(79) 'stream' drivers/usb/host/ehci-hcd.c +2036 sitd_complete(64) 'stream' drivers/uwb/reset.c +193 __uwb_rc_cmd(26) 'cmd' net/netfilter/nfnetlink_log.c +341 __nfulnl_flush(5) 'inst' net/netfilter/xt_recent.c +273 recent_mt(69) 'e' drivers/media/radio/radio-si470x.c +1144 si470x_fops_release(32) 'radio' drivers/media/radio/radio-si470x.c +1722 si470x_usb_driver_disconnect(13) 'radio' drivers/media/radio/radio-si470x.c +1144 si470x_fops_release(32) 'radio' drivers/media/radio/radio-si470x.c +1722 si470x_usb_driver_disconnect(13) 'radio' drivers/media/video/cpia_pp.c +777 cpia_pp_detach(28) 'cpia' drivers/media/video/s2255drv.c +1711 s2255_destroy(42) 'dev' drivers/mtd/mtd_blkdevs.c +389 register_mtd_blktrans(49) '*tr->blkcore_priv' drivers/net/usb/hso.c +2616 hso_free_tiomget(5) 'tiocmget'
These mostly seem like real bugs.
regards, dan carpenter
| |