From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756443Ab0C3X4g (ORCPT ); Tue, 30 Mar 2010 19:56:36 -0400 Received: from kroah.org ([198.145.64.141]:45604 "EHLO coco.kroah.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932366Ab0C3XTL (ORCPT ); Tue, 30 Mar 2010 19:19:11 -0400 X-Mailbox-Line: From linux@linux.site Tue Mar 30 15:47:22 2010 Message-Id: <20100330224721.438343262@linux.site> User-Agent: quilt/0.47-14.9 Date: Tue, 30 Mar 2010 15:40:35 -0700 From: Greg KH To: linux-kernel@vger.kernel.org, stable@kernel.org Cc: stable-review@kernel.org, torvalds@linux-foundation.org, akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk, Julia Lawall , James Bottomley , Greg Kroah-Hartman Subject: [001/156] drivers/scsi/ses.c: eliminate double free In-Reply-To: <20100330230630.GA28824@kroah.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 2.6.33-stable review patch. If anyone has any objections, please let us know. ------------------ From: Julia Lawall commit 9b3a6549b2602ca30f58715a0071e29f9898cae9 upstream. The few lines below the kfree of hdr_buf may go to the label err_free which will also free hdr_buf. The most straightforward solution seems to be to just move the kfree of hdr_buf after these gotos. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // @r@ identifier E; expression E1; iterator I; statement S; @@ *kfree(E); ... when != E = E1 when != I(E,...) S when != &E *kfree(E); // Signed-off-by: Julia Lawall Cc: James Bottomley Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- drivers/scsi/ses.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/scsi/ses.c +++ b/drivers/scsi/ses.c @@ -591,8 +591,6 @@ static int ses_intf_add(struct device *c ses_dev->page10_len = len; buf = NULL; } - kfree(hdr_buf); - scomp = kzalloc(sizeof(struct ses_component) * components, GFP_KERNEL); if (!scomp) goto err_free; @@ -604,6 +602,8 @@ static int ses_intf_add(struct device *c goto err_free; } + kfree(hdr_buf); + edev->scratch = ses_dev; for (i = 0; i < components; i++) edev->component[i].scratch = scomp + i;