lkml.org 
[lkml]   [2009]   [Mar]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectDereferencing freed memory bugs
From
I added a check to smatch (http://repo.or.cz/w/smatch.git/) to check
for when we dereference
freed memory.

drivers/dma/dmatest.c +410 dmatest_exit(7) 'dtc'
drivers/dma/dmatest.c +412 dmatest_exit(9) 'dtc'
drivers/infiniband/hw/nes/nes_cm.c +563 nes_cm_timer_tick(121) 'cm_node'
drivers/infiniband/hw/nes/nes_cm.c +621 nes_cm_timer_tick(179) 'cm_node'
drivers/scsi/dpt_i2o.c +246 adpt_detect(58) 'pHba'
drivers/scsi/dpt_i2o.c +266 adpt_detect(78) 'pHba'
drivers/scsi/dpt_i2o.c +1236 adpt_i2o_delete_hba(78) 'pHba'
drivers/usb/host/ehci-hcd.c +1661 itd_complete(79) 'stream'
drivers/usb/host/ehci-hcd.c +2036 sitd_complete(64) 'stream'
drivers/uwb/reset.c +193 __uwb_rc_cmd(26) 'cmd'
net/netfilter/nfnetlink_log.c +341 __nfulnl_flush(5) 'inst'
net/netfilter/xt_recent.c +273 recent_mt(69) 'e'
drivers/media/radio/radio-si470x.c +1144 si470x_fops_release(32) 'radio'
drivers/media/radio/radio-si470x.c +1722
si470x_usb_driver_disconnect(13) 'radio'
drivers/media/radio/radio-si470x.c +1144 si470x_fops_release(32) 'radio'
drivers/media/radio/radio-si470x.c +1722
si470x_usb_driver_disconnect(13) 'radio'
drivers/media/video/cpia_pp.c +777 cpia_pp_detach(28) 'cpia'
drivers/media/video/s2255drv.c +1711 s2255_destroy(42) 'dev'
drivers/mtd/mtd_blkdevs.c +389 register_mtd_blktrans(49) '*tr->blkcore_priv'
drivers/net/usb/hso.c +2616 hso_free_tiomget(5) 'tiocmget'

These mostly seem like real bugs.

regards,
dan carpenter


\
 
 \ /
  Last update: 2009-03-24 13:31    [W:0.257 / U:0.164 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site