A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-30 19:51:31 -04:00
Code Issues Projects Releases Packages Wiki Activity

9p: fix use after free

Browse source 
On 7/22/07, Adrian Bunk <[email protected]> wrote:
     The Coverity checker spotted the following use-after-free
     in net/9p/mux.c:

     <--  snip  -->

     ...
     struct p9_conn *p9_conn_create(struct p9_transport *trans, int msize,
                                         unsigned char *extended)
     {
     ...
             if (!m->tagpool) {
                     kfree(m);
                     return ERR_PTR(PTR_ERR(m->tagpool));
             }
     ...

     <--  snip  -->

Also spotted was a leak of the same structure further down in the function.

Signed-off-by: Eric Van Hensbergen <[email protected]>
This commit is contained in:
Eric Van Hensbergen 2007-07-26 14:04:54 -05:00 • committed by Eric Van Hensbergen
commit 1a3cac6c6d
1 changed files with 6 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

9
net/9p/mux.c
View file

@ -288,9 +288,10 @@ struct p9_conn *p9_conn_create(struct p9_transport *trans, int msize,
m->extended = extended;
m->trans = trans;
m->tagpool = p9_idpool_create();
if (!m->tagpool) {
if (IS_ERR(m->tagpool)) {
mtmp = ERR_PTR(-ENOMEM);
kfree(m);
return ERR_PTR(PTR_ERR(m->tagpool));
return mtmp;
}
m->err = 0;
@ -308,8 +309,10 @@ struct p9_conn *p9_conn_create(struct p9_transport *trans, int msize,
memset(&m->poll_waddr, 0, sizeof(m->poll_waddr));
m->poll_task = NULL;
n = p9_mux_poll_start(m);
if (n)
if (n) {
kfree(m);
return ERR_PTR(n);
}
n = trans->poll(trans, &m->pt);
if (n & POLLIN) {