From: Eric Sesterhenn <snakebyte@gmx.de>
To: LKML <linux-kernel@vger.kernel.org>
Cc: mchehab@brturbo.com.br
Subject: [Patch] use after free in drivers/media/video/em28xx/em28xx-video.c
Date: Mon, 10 Apr 2006 23:56:05 +0200 [thread overview]
Message-ID: <1144706165.31602.2.camel@alice> (raw)
hi,
in several we use dev->devno right after we kfree()
dev. This fixes coverity bug id #1065
Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
--- linux-2.6.17-rc1/drivers/media/video/em28xx/em28xx-video.c.orig 2006-04-10 23:49:05.000000000 +0200
+++ linux-2.6.17-rc1/drivers/media/video/em28xx/em28xx-video.c 2006-04-10 23:50:05.000000000 +0200
@@ -1576,8 +1576,8 @@ static int em28xx_init_dev(struct em28xx
errCode = em28xx_config(dev);
if (errCode) {
em28xx_errdev("error configuring device\n");
- kfree(dev);
em28xx_devused&=~(1<<dev->devno);
+ kfree(dev);
return -ENOMEM;
}
@@ -1603,8 +1603,8 @@ static int em28xx_init_dev(struct em28xx
dev->vdev = video_device_alloc();
if (NULL == dev->vdev) {
em28xx_errdev("cannot allocate video_device.\n");
- kfree(dev);
em28xx_devused&=~(1<<dev->devno);
+ kfree(dev);
return -ENOMEM;
}
@@ -1612,8 +1612,8 @@ static int em28xx_init_dev(struct em28xx
if (NULL == dev->vbi_dev) {
em28xx_errdev("cannot allocate video_device.\n");
kfree(dev->vdev);
- kfree(dev);
em28xx_devused&=~(1<<dev->devno);
+ kfree(dev);
return -ENOMEM;
}
@@ -1650,8 +1650,8 @@ static int em28xx_init_dev(struct em28xx
mutex_unlock(&dev->lock);
list_del(&dev->devlist);
video_device_release(dev->vdev);
- kfree(dev);
em28xx_devused&=~(1<<dev->devno);
+ kfree(dev);
return -ENODEV;
}
@@ -1662,8 +1662,8 @@ static int em28xx_init_dev(struct em28xx
list_del(&dev->devlist);
video_device_release(dev->vbi_dev);
video_device_release(dev->vdev);
- kfree(dev);
em28xx_devused&=~(1<<dev->devno);
+ kfree(dev);
return -ENODEV;
} else {
printk("registered VBI\n");
reply other threads:[~2006-04-10 21:56 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1144706165.31602.2.camel@alice \
--to=snakebyte@gmx.de \
--cc=linux-kernel@vger.kernel.org \
--cc=mchehab@brturbo.com.br \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox