Messages in this thread |  | | | Subject | Re: [PATCH] staging; lirc, zilog: put_ir_rx may free 'rx' which can lead to double free | | From | Andy Walls <> | | Date | Fri, 29 Jul 2011 06:03:10 -0400 |
| |
Dan Carpenter <error27@gmail.com> wrote:
>On Thu, Jul 28, 2011 at 11:49:51PM +0200, Jesper Juhl wrote: >> If calling put_ir_rx(rx, true); in >> drivers/staging/lirc/lirc_zilog.c::ir_probe() returns true (1) then >it >> means that it has freed it's first argument. Subsequently jumping to >> 'out_put_xx' will cause us to call put_ir_rx() once more since 'rx' >is >> not zero - leading to a double free. > >It would be better to just remove the first call to put_ir_rx(). > >regards, >dan carpenter
Jesper,
Could you forward your original patch email to me? I never got it.
I was the one who added all the new ref counting to lirc_zilog and it was not fun to get right (well at least what I thought was right...).
Regards, Andy
|  |