* [PATCH] Double-free in cx23885_initdev
@ 2007-10-13 14:49 Florin Malita
2007-10-13 15:46 ` [PATCH] Double-free in cx23885_initdev [sls][spam-bayes] Steven Toth
0 siblings, 1 reply; 2+ messages in thread
From: Florin Malita @ 2007-10-13 14:49 UTC (permalink / raw)
To: stoth; +Cc: mchehab, Linux Kernel Mailing List
Both cx23885_initdev and cx23885_dev_setup free the device in their
error path so a failure in the latter causes a double-free. Since
cx23885_dev_setup is only called from cx23885_initdev, it should be safe
to remove its deallocation and leave the cleanup up to the allocating
function.
Coverity CID 1922.
Signed-off-by: Florin Malita <fmalita@gmail.com>
---
drivers/media/video/cx23885/cx23885-core.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
diff --git a/drivers/media/video/cx23885/cx23885-core.c b/drivers/media/video/cx23885/cx23885-core.c
index af16505..3cdd136 100644
--- a/drivers/media/video/cx23885/cx23885-core.c
+++ b/drivers/media/video/cx23885/cx23885-core.c
@@ -793,7 +793,7 @@ static int cx23885_dev_setup(struct cx23885_dev *dev)
dev->pci->subsystem_device);
cx23885_devcount--;
- goto fail_free;
+ return -ENODEV;
}
/* PCIe stuff */
@@ -835,10 +835,6 @@ static int cx23885_dev_setup(struct cx23885_dev *dev)
}
return 0;
-
-fail_free:
- kfree(dev);
- return -ENODEV;
}
void cx23885_dev_unregister(struct cx23885_dev *dev)
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] Double-free in cx23885_initdev [sls][spam-bayes]
2007-10-13 14:49 [PATCH] Double-free in cx23885_initdev Florin Malita
@ 2007-10-13 15:46 ` Steven Toth
0 siblings, 0 replies; 2+ messages in thread
From: Steven Toth @ 2007-10-13 15:46 UTC (permalink / raw)
To: Florin Malita; +Cc: mchehab@infradead.org, Linux Kernel Mailing List
Thanks for the patch, much appreciated.
- Steve
Florin Malita wrote:
> Both cx23885_initdev and cx23885_dev_setup free the device in their
> error path so a failure in the latter causes a double-free. Since
> cx23885_dev_setup is only called from cx23885_initdev, it should be safe
> to remove its deallocation and leave the cleanup up to the allocating
> function.
>
> Coverity CID 1922.
>
> Signed-off-by: Florin Malita <fmalita@gmail.com>
> ---
>
> drivers/media/video/cx23885/cx23885-core.c | 6 +-----
> 1 file changed, 1 insertion(+), 5 deletions(-)
>
> diff --git a/drivers/media/video/cx23885/cx23885-core.c b/drivers/media/video/cx23885/cx23885-core.c
> index af16505..3cdd136 100644
> --- a/drivers/media/video/cx23885/cx23885-core.c
> +++ b/drivers/media/video/cx23885/cx23885-core.c
> @@ -793,7 +793,7 @@ static int cx23885_dev_setup(struct cx23885_dev *dev)
> dev->pci->subsystem_device);
>
> cx23885_devcount--;
> - goto fail_free;
> + return -ENODEV;
> }
>
> /* PCIe stuff */
> @@ -835,10 +835,6 @@ static int cx23885_dev_setup(struct cx23885_dev *dev)
> }
>
> return 0;
> -
> -fail_free:
> - kfree(dev);
> - return -ENODEV;
> }
>
> void cx23885_dev_unregister(struct cx23885_dev *dev)
>
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2007-10-13 15:46 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2007-10-13 14:49 [PATCH] Double-free in cx23885_initdev Florin Malita
2007-10-13 15:46 ` [PATCH] Double-free in cx23885_initdev [sls][spam-bayes] Steven Toth
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox