The Coverity checker spotted the following use-after-free
in net/9p/mux.c:
<-- snip -->
...
struct p9_conn *p9_conn_create(struct p9_transport *trans, int msize,
unsigned char *extended)
{
...
if (!m->tagpool) {
kfree(m);
return ERR_PTR(PTR_ERR(m->tagpool));
}
...
<-- snip -->
cu
Adrian
--
"Is there not promise of rain?" Ling Tan asked suddenly out
of the darkness. There had been need of rain for many days.
"Only a promise," Lao Er said.
Pearl S. Buck - Dragon Seed
On 7/22/07, Adrian Bunk [off-list ref] wrote:
The Coverity checker spotted the following use-after-free
in net/9p/mux.c:
<-- snip -->
...
struct p9_conn *p9_conn_create(struct p9_transport *trans, int msize,
unsigned char *extended)
{
...
if (!m->tagpool) {
kfree(m);
return ERR_PTR(PTR_ERR(m->tagpool));
}
...
<-- snip -->
I've got a fix for this one:
if (!m->tagpool) {
mtmp = ERR_PTR(PTR_ERR(m->tagpool));
kfree(m);
return mtmp;
}
but I was wondering about one of the other returns further down the function:
...
memset(&m->poll_waddr, 0, sizeof(m->poll_waddr));
m->poll_task = NULL;
n = p9_mux_poll_start(m);
if (n)
return ERR_PTR(n);
n = trans->poll(trans, &m->pt);
...
lucho: doesn't that constitute a leak? Shouldn't we be doing:
if (n) {
kfree(m);
return ERR_PTR(n);
}
-eric
Yep, it's a leak.
Thanks,
Lucho
On 7/25/07, Eric Van Hensbergen [off-list ref] wrote:On 7/22/07, Adrian Bunk [off-list ref] wrote:
quoted
The Coverity checker spotted the following use-after-free
in net/9p/mux.c:
<-- snip -->
...
struct p9_conn *p9_conn_create(struct p9_transport *trans, int msize,
unsigned char *extended)
{
...
if (!m->tagpool) {
kfree(m);
return ERR_PTR(PTR_ERR(m->tagpool));
}
...
<-- snip -->
I've got a fix for this one:
if (!m->tagpool) {
mtmp = ERR_PTR(PTR_ERR(m->tagpool));
kfree(m);
return mtmp;
}
but I was wondering about one of the other returns further down the function:
...
memset(&m->poll_waddr, 0, sizeof(m->poll_waddr));
m->poll_task = NULL;
n = p9_mux_poll_start(m);
if (n)
return ERR_PTR(n);
n = trans->poll(trans, &m->pt);
...
lucho: doesn't that constitute a leak? Shouldn't we be doing:
if (n) {
kfree(m);
return ERR_PTR(n);
}
-eric
On 7/25/07, Latchesar Ionkov [off-list ref] wrote:
Yep, it's a leak.
Okay, I'll roll that into the patch as well.
-eric