UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity

V4L/DVB (13948): radio: Correct use after free 

It is not clear how to share the unlock in the case where the structure
containing the lock has to be freed.  So the unlock is now duplicated, with
one copy moved before the free.  The unlock label furthermore is no longer
useful and is thus deleted.

A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@@
expression x,e;
identifier f;
iterator I;
statement S;
@@

*kfree(x);
... when != &x
    when != x = e
    when != I(x,...) S
*x->f
// </smpl>

Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
This commit is contained in:
Julia Lawall 2009-12-22 17:31:23 -03:00 committed by Mauro Carvalho Chehab
parent e0572325d2
commit ed0ee8e1fb
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/media/radio/si470x/radio-si470x-usb.c
View File

@ -590,8 +590,9 @@ int si470x_fops_release(struct file *file)
video_unregister_device(radio->videodev);
kfree(radio->int_in_buffer);
kfree(radio->buffer);
mutex_unlock(&radio->disconnect_lock);
kfree(radio);
goto unlock;
goto done;
}
/* cancel read processes */
@ -601,7 +602,6 @@ int si470x_fops_release(struct file *file)
retval = si470x_stop(radio);
usb_autopm_put_interface(radio->intf);
}
unlock:
mutex_unlock(&radio->disconnect_lock);
done:
return retval;