* drivers/edac/ move a kfree() to after last use @ 2009-12-21 4:38 ` Darren Jenkins 0 siblings, 0 replies; 4+ messages in thread From: Darren Jenkins @ 2009-12-21 4:38 UTC (permalink / raw) To: Kernel Janitors, Linux Kernel Mailing List, dougthompson, borislav.petkov Cc: bluesmoke-devel Move a kfree() below the last use of the memory Coverity CID: 13142 Signed-off-by: Darren Jenkins <darrenrjenkins@gmail.com> diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c index df5b684..15b8b3c 100644 --- a/drivers/edac/amd64_edac.c +++ b/drivers/edac/amd64_edac.c @@ -2925,10 +2925,10 @@ static void __devexit amd64_remove_one_instance(struct pci_dev *pdev) amd64_free_mc_sibling_devices(pvt); - kfree(pvt); mci->pvt_info = NULL; mci_lookup[pvt->mc_node_id] = NULL; + kfree(pvt); /* unregister from EDAC MCE */ amd_report_gart_errors(false); ^ permalink raw reply related [flat|nested] 4+ messages in thread
* drivers/edac/ move a kfree() to after last use @ 2009-12-21 4:38 ` Darren Jenkins 0 siblings, 0 replies; 4+ messages in thread From: Darren Jenkins @ 2009-12-21 4:38 UTC (permalink / raw) To: Kernel Janitors, Linux Kernel Mailing List, dougthompson, borislav.petkov Cc: bluesmoke-devel Move a kfree() below the last use of the memory Coverity CID: 13142 Signed-off-by: Darren Jenkins <darrenrjenkins@gmail.com> diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c index df5b684..15b8b3c 100644 --- a/drivers/edac/amd64_edac.c +++ b/drivers/edac/amd64_edac.c @@ -2925,10 +2925,10 @@ static void __devexit amd64_remove_one_instance(struct pci_dev *pdev) amd64_free_mc_sibling_devices(pvt); - kfree(pvt); mci->pvt_info = NULL; mci_lookup[pvt->mc_node_id] = NULL; + kfree(pvt); /* unregister from EDAC MCE */ amd_report_gart_errors(false); ^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: drivers/edac/ move a kfree() to after last use 2009-12-21 4:38 ` Darren Jenkins @ 2009-12-21 15:18 ` Borislav Petkov -1 siblings, 0 replies; 4+ messages in thread From: Borislav Petkov @ 2009-12-21 15:18 UTC (permalink / raw) To: Darren Jenkins Cc: Kernel Janitors, Linux Kernel Mailing List, dougthompson, bluesmoke-devel On Mon, Dec 21, 2009 at 03:38:26PM +1100, Darren Jenkins wrote: > > Move a kfree() below the last use of the memory > > Coverity CID: 13142 > > Signed-off-by: Darren Jenkins <darrenrjenkins@gmail.com> Thanks for catching that. Here's a better version that does all the freeing at the end of the function. -- From: Borislav Petkov <borislav.petkov@amd.com> Date: Mon, 21 Dec 2009 15:15:59 +0100 Subject: [PATCH] amd64_edac: fix driver instance freeing Fix use-after-free errors by pushing all memory-freeing calls to the end of amd64_remove_one_instance(). Reported-by: Darren Jenkins <darrenrjenkins@gmail.com> Signed-off-by: Borislav Petkov <borislav.petkov@amd.com> --- drivers/edac/amd64_edac.c | 9 ++++----- 1 files changed, 4 insertions(+), 5 deletions(-) diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c index 784cc5a..fb0d36b 100644 --- a/drivers/edac/amd64_edac.c +++ b/drivers/edac/amd64_edac.c @@ -2929,16 +2929,15 @@ static void __devexit amd64_remove_one_instance(struct pci_dev *pdev) amd64_free_mc_sibling_devices(pvt); - kfree(pvt); - mci->pvt_info = NULL; - - mci_lookup[pvt->mc_node_id] = NULL; - /* unregister from EDAC MCE */ amd_report_gart_errors(false); amd_unregister_ecc_decoder(amd64_decode_bus_error); /* Free the EDAC CORE resources */ + mci->pvt_info = NULL; + mci_lookup[pvt->mc_node_id] = NULL; + + kfree(pvt); edac_mc_free(mci); } -- 1.6.5.4 -- Regards/Gruss, Boris. Operating | Advanced Micro Devices GmbH System | Karl-Hammerschmidt-Str. 34, 85609 Dornach b. München, Germany Research | Geschäftsführer: Andrew Bowd, Thomas M. McCoy, Giuliano Meroni Center | Sitz: Dornach, Gemeinde Aschheim, Landkreis München (OSRC) | Registergericht München, HRB Nr. 43632 -- To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html ^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: drivers/edac/ move a kfree() to after last use @ 2009-12-21 15:18 ` Borislav Petkov 0 siblings, 0 replies; 4+ messages in thread From: Borislav Petkov @ 2009-12-21 15:18 UTC (permalink / raw) To: Darren Jenkins Cc: Kernel Janitors, Linux Kernel Mailing List, dougthompson, bluesmoke-devel On Mon, Dec 21, 2009 at 03:38:26PM +1100, Darren Jenkins wrote: > > Move a kfree() below the last use of the memory > > Coverity CID: 13142 > > Signed-off-by: Darren Jenkins <darrenrjenkins@gmail.com> Thanks for catching that. Here's a better version that does all the freeing at the end of the function. -- From: Borislav Petkov <borislav.petkov@amd.com> Date: Mon, 21 Dec 2009 15:15:59 +0100 Subject: [PATCH] amd64_edac: fix driver instance freeing Fix use-after-free errors by pushing all memory-freeing calls to the end of amd64_remove_one_instance(). Reported-by: Darren Jenkins <darrenrjenkins@gmail.com> Signed-off-by: Borislav Petkov <borislav.petkov@amd.com> --- drivers/edac/amd64_edac.c | 9 ++++----- 1 files changed, 4 insertions(+), 5 deletions(-) diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c index 784cc5a..fb0d36b 100644 --- a/drivers/edac/amd64_edac.c +++ b/drivers/edac/amd64_edac.c @@ -2929,16 +2929,15 @@ static void __devexit amd64_remove_one_instance(struct pci_dev *pdev) amd64_free_mc_sibling_devices(pvt); - kfree(pvt); - mci->pvt_info = NULL; - - mci_lookup[pvt->mc_node_id] = NULL; - /* unregister from EDAC MCE */ amd_report_gart_errors(false); amd_unregister_ecc_decoder(amd64_decode_bus_error); /* Free the EDAC CORE resources */ + mci->pvt_info = NULL; + mci_lookup[pvt->mc_node_id] = NULL; + + kfree(pvt); edac_mc_free(mci); } -- 1.6.5.4 -- Regards/Gruss, Boris. Operating | Advanced Micro Devices GmbH System | Karl-Hammerschmidt-Str. 34, 85609 Dornach b. München, Germany Research | Geschäftsführer: Andrew Bowd, Thomas M. McCoy, Giuliano Meroni Center | Sitz: Dornach, Gemeinde Aschheim, Landkreis München (OSRC) | Registergericht München, HRB Nr. 43632 ^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2009-12-21 15:18 UTC | newest] Thread overview: 4+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2009-12-21 4:38 drivers/edac/ move a kfree() to after last use Darren Jenkins 2009-12-21 4:38 ` Darren Jenkins 2009-12-21 15:18 ` Borislav Petkov 2009-12-21 15:18 ` Borislav Petkov
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.