linux-kernel - [PATCH 14/24] misc: fix dangling pointers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 20 Mar 2010 15:12:55 +0100
From:	Wolfram Sang <w.sang@...gutronix.de>
To:	kernel-janitors@...r.kernel.org
Cc:	linux-i2c@...r.kernel.org, linux-kernel@...r.kernel.org,
	Wolfram Sang <w.sang@...gutronix.de>
Subject: [PATCH 14/24] misc: fix dangling pointers

Fix I2C-drivers which missed setting clientdata to NULL before freeing the
structure it points to. Also fix drivers which do this _after_ the structure
was freed already.

Signed-off-by: Wolfram Sang <w.sang@...gutronix.de>
---

Found using coccinelle, then reviewed. Full patchset is available via
kernel-janitors, linux-i2c, and LKML.
---
 drivers/misc/ad525x_dpot.c |    2 +-
 drivers/misc/ics932s401.c  |    2 ++
 drivers/misc/isl29003.c    |    6 +++++-
 drivers/misc/tsl2550.c     |    6 +++++-
 4 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/drivers/misc/ad525x_dpot.c b/drivers/misc/ad525x_dpot.c
index 30a59f2..3b6f437 100644
--- a/drivers/misc/ad525x_dpot.c
+++ b/drivers/misc/ad525x_dpot.c
@@ -567,8 +567,8 @@ static int ad525x_probe(struct i2c_client *client,
 	return 0;
 
 exit_free:
-	kfree(data);
 	i2c_set_clientdata(client, NULL);
+	kfree(data);
 exit:
 	dev_err(dev, "failed to create client\n");
 	return err;
diff --git a/drivers/misc/ics932s401.c b/drivers/misc/ics932s401.c
index 395a4ea..f60b7e7 100644
--- a/drivers/misc/ics932s401.c
+++ b/drivers/misc/ics932s401.c
@@ -465,6 +465,7 @@ static int ics932s401_probe(struct i2c_client *client,
 	return 0;
 
 exit_free:
+	i2c_set_clientdata(client, NULL);
 	kfree(data);
 exit:
 	return err;
@@ -475,6 +476,7 @@ static int ics932s401_remove(struct i2c_client *client)
 	struct ics932s401_data *data = i2c_get_clientdata(client);
 
 	sysfs_remove_group(&client->dev.kobj, &data->attrs);
+	i2c_set_clientdata(client, NULL);
 	kfree(data);
 	return 0;
 }
diff --git a/drivers/misc/isl29003.c b/drivers/misc/isl29003.c
index a71e245..5bd4d8b 100644
--- a/drivers/misc/isl29003.c
+++ b/drivers/misc/isl29003.c
@@ -397,15 +397,19 @@ static int __devinit isl29003_probe(struct i2c_client *client,
 	return 0;
 
 exit_kfree:
+	i2c_set_clientdata(client, NULL);
 	kfree(data);
 	return err;
 }
 
 static int __devexit isl29003_remove(struct i2c_client *client)
 {
+	struct isl29003_data *data = i2c_get_clientdata(client);
+
 	sysfs_remove_group(&client->dev.kobj, &isl29003_attr_group);
 	isl29003_set_power_state(client, 0);
-	kfree(i2c_get_clientdata(client));
+	i2c_set_clientdata(client, NULL);
+	kfree(data);
 	return 0;
 }
 
diff --git a/drivers/misc/tsl2550.c b/drivers/misc/tsl2550.c
index 483ae5f..230c326 100644
--- a/drivers/misc/tsl2550.c
+++ b/drivers/misc/tsl2550.c
@@ -400,6 +400,7 @@ static int __devinit tsl2550_probe(struct i2c_client *client,
 	return 0;
 
 exit_kfree:
+	i2c_set_clientdata(client, NULL);
 	kfree(data);
 exit:
 	return err;
@@ -407,12 +408,15 @@ exit:
 
 static int __devexit tsl2550_remove(struct i2c_client *client)
 {
+	struct tsl2550_data *data = i2c_get_clientdata(client);
+
 	sysfs_remove_group(&client->dev.kobj, &tsl2550_attr_group);
 
 	/* Power down the device */
 	tsl2550_set_power_state(client, 0);
 
-	kfree(i2c_get_clientdata(client));
+	i2c_set_clientdata(client, NULL);
+	kfree(data);
 
 	return 0;
 }
-- 
1.7.0

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/