* [patch] isdn: gigaset: use after free
@ 2010-08-06 8:21 Dan Carpenter
2010-08-08 6:04 ` David Miller
2010-08-08 12:55 ` Tilman Schmidt
0 siblings, 2 replies; 3+ messages in thread
From: Dan Carpenter @ 2010-08-06 8:21 UTC (permalink / raw)
To: Hansjoerg Lipp
Cc: Tilman Schmidt, Karsten Keil, David S. Miller, Tejun Heo,
Joe Perches, gigaset307x-common, netdev, kernel-janitors
I moved the kfree(cb) below the dereferences.
Signed-off-by: Dan Carpenter <error27@gmail.com>
diff --git a/drivers/isdn/gigaset/bas-gigaset.c b/drivers/isdn/gigaset/bas-gigaset.c
index 0ded364..707d9c9 100644
--- a/drivers/isdn/gigaset/bas-gigaset.c
+++ b/drivers/isdn/gigaset/bas-gigaset.c
@@ -1914,11 +1914,13 @@ static int gigaset_write_cmd(struct cardstate *cs, struct cmdbuf_t *cb)
* The next command will reopen the AT channel automatically.
*/
if (cb->len == 3 && !memcmp(cb->buf, "+++", 3)) {
- kfree(cb);
rc = req_submit(cs->bcs, HD_CLOSE_ATCHANNEL, 0, BAS_TIMEOUT);
if (cb->wake_tasklet)
tasklet_schedule(cb->wake_tasklet);
- return rc < 0 ? rc : cb->len;
+ if (!rc)
+ rc = cb->len;
+ kfree(cb);
+ return rc;
}
spin_lock_irqsave(&cs->cmdlock, flags);
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [patch] isdn: gigaset: use after free
2010-08-06 8:21 [patch] isdn: gigaset: use after free Dan Carpenter
@ 2010-08-08 6:04 ` David Miller
2010-08-08 12:55 ` Tilman Schmidt
1 sibling, 0 replies; 3+ messages in thread
From: David Miller @ 2010-08-08 6:04 UTC (permalink / raw)
To: error27
Cc: hjlipp, tilman, isdn, tj, joe, gigaset307x-common, netdev,
kernel-janitors
From: Dan Carpenter <error27@gmail.com>
Date: Fri, 6 Aug 2010 10:21:26 +0200
> I moved the kfree(cb) below the dereferences.
>
> Signed-off-by: Dan Carpenter <error27@gmail.com>
Applied.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [patch] isdn: gigaset: use after free
2010-08-06 8:21 [patch] isdn: gigaset: use after free Dan Carpenter
2010-08-08 6:04 ` David Miller
@ 2010-08-08 12:55 ` Tilman Schmidt
1 sibling, 0 replies; 3+ messages in thread
From: Tilman Schmidt @ 2010-08-08 12:55 UTC (permalink / raw)
To: Dan Carpenter
Cc: Hansjoerg Lipp, Karsten Keil, David S. Miller, Tejun Heo,
Joe Perches, gigaset307x-common, netdev, kernel-janitors
[-- Attachment #1: Type: text/plain, Size: 1192 bytes --]
Am 06.08.2010 10:21 schrieb Dan Carpenter:
> I moved the kfree(cb) below the dereferences.
Thanks for finding and fixing that bug.
> Signed-off-by: Dan Carpenter <error27@gmail.com>
Acked-by: Tilman Schmidt <tilman@imap.cc>
> diff --git a/drivers/isdn/gigaset/bas-gigaset.c b/drivers/isdn/gigaset/bas-gigaset.c
> index 0ded364..707d9c9 100644
> --- a/drivers/isdn/gigaset/bas-gigaset.c
> +++ b/drivers/isdn/gigaset/bas-gigaset.c
> @@ -1914,11 +1914,13 @@ static int gigaset_write_cmd(struct cardstate *cs, struct cmdbuf_t *cb)
> * The next command will reopen the AT channel automatically.
> */
> if (cb->len == 3 && !memcmp(cb->buf, "+++", 3)) {
> - kfree(cb);
> rc = req_submit(cs->bcs, HD_CLOSE_ATCHANNEL, 0, BAS_TIMEOUT);
> if (cb->wake_tasklet)
> tasklet_schedule(cb->wake_tasklet);
> - return rc < 0 ? rc : cb->len;
> + if (!rc)
> + rc = cb->len;
> + kfree(cb);
> + return rc;
> }
>
> spin_lock_irqsave(&cs->cmdlock, flags);
--
Tilman Schmidt E-Mail: tilman@imap.cc
Bonn, Germany
Diese Nachricht besteht zu 100% aus wiederverwerteten Bits.
Ungeöffnet mindestens haltbar bis: (siehe Rückseite)
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 259 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2010-08-08 12:55 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-08-06 8:21 [patch] isdn: gigaset: use after free Dan Carpenter
2010-08-08 6:04 ` David Miller
2010-08-08 12:55 ` Tilman Schmidt
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).