All of lore.kernel.org
 help / color / mirror / Atom feed
From: Florin Malita <fmalita@gmail.com>
To: stoth@hauppauge.com
Cc: mchehab@infradead.org,
	Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
Subject: [PATCH] Double-free in cx23885_initdev
Date: Sat, 13 Oct 2007 10:49:52 -0400	[thread overview]
Message-ID: <4710DB10.2000107@gmail.com> (raw)

Both cx23885_initdev and cx23885_dev_setup free the device in their 
error path so a failure in the latter causes a double-free. Since 
cx23885_dev_setup is only called from cx23885_initdev, it should be safe 
to remove its deallocation and leave the cleanup up to the allocating 
function.

Coverity CID 1922.

Signed-off-by: Florin Malita <fmalita@gmail.com>
---

 drivers/media/video/cx23885/cx23885-core.c |    6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/drivers/media/video/cx23885/cx23885-core.c b/drivers/media/video/cx23885/cx23885-core.c
index af16505..3cdd136 100644
--- a/drivers/media/video/cx23885/cx23885-core.c
+++ b/drivers/media/video/cx23885/cx23885-core.c
@@ -793,7 +793,7 @@ static int cx23885_dev_setup(struct cx23885_dev *dev)
 		       dev->pci->subsystem_device);
 
 		cx23885_devcount--;
-		goto fail_free;
+		return -ENODEV;
 	}
 
 	/* PCIe stuff */
@@ -835,10 +835,6 @@ static int cx23885_dev_setup(struct cx23885_dev *dev)
 	}
 
 	return 0;
-
-fail_free:
-	kfree(dev);
-	return -ENODEV;
 }
 
 void cx23885_dev_unregister(struct cx23885_dev *dev)


             reply	other threads:[~2007-10-13 15:00 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2007-10-13 14:49 Florin Malita [this message]
2007-10-13 15:46 ` [PATCH] Double-free in cx23885_initdev [sls][spam-bayes] Steven Toth

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=4710DB10.2000107@gmail.com \
    --to=fmalita@gmail.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mchehab@infradead.org \
    --cc=stoth@hauppauge.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.