lkml.org 
[lkml]   [2004]   [Oct]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] firmware_class: avoid double free
Date
The error exit path in request_firmware frees the allocated
struct firmware *firmware, which is good. What is not so good
is that the value of firmware has already been copied out to the
caller as *firmware_p. The risk is that the caller will pass this
to release_firmware, a double free. This is exactly what will
happen if the caller copied the example code

if(request_firmware(&fw_entry, $FIRMWARE, device) == 0)
copy_fw_to_device(fw_entry->data, fw_entry->size);
release(fw_entry);

from the firmware documentation.

--- mm/drivers/base/firmware_class.c.orig 2004-10-02 18:43:00.323005656 +0200
+++ mm/drivers/base/firmware_class.c 2004-10-02 18:43:37.500448654 +0200
@@ -441,6 +441,7 @@

error_kfree_fw:
kfree(firmware);
+ *firmware_p = NULL;
out:
return retval;
}
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
\
 
 \ /
  Last update: 2005-03-22 14:06    [W:2.335 / U:0.000 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site