linux-kernel - [PATCH] staging/vme_user: fix usage of the slave resources after they've been freed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20101203090508.31963.9563.stgit@ES-BJ21R4J>
Date:	Fri, 03 Dec 2010 09:05:08 +0000
From:	Martyn Welch <martyn.welch@...com>
To:	Greg KH <greg@...ah.com>
Cc:	devel@...verdev.osuosl.org,
	Juan David Gonzalez Cobas <david.cobas@...il.com>,
	"Emilio G. Cota" <cota@...ap.org>,
	LKML <linux-kernel@...r.kernel.org>,
	Bill Pemberton <wfp5p@...ginia.edu>
Subject: [PATCH] staging/vme_user: fix usage of the slave resources after
	they've been freed

From: Emilio G. Cota <cota@...ap.org>

buf_unalloc() frees the memory buffers allocated with vme_alloc_consistent.
The associated VME resource is needed in both vme_alloc_consistent and
vme_free_consistent; however the slave VME resources are being freed before
the calls to vme_free_consistent are made, which means the buffers
are never returned.

Fix this by freeing the VME resources only after the consistent buffers have
been returned.

Signed-off-by: Emilio G. Cota <cota@...ap.org>
Acked-by: Martyn Welch <martyn.welch@...com>
---

 drivers/staging/vme/devices/vme_user.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)


diff --git a/drivers/staging/vme/devices/vme_user.c b/drivers/staging/vme/devices/vme_user.c
index 3638148..dc7175b 100644
--- a/drivers/staging/vme/devices/vme_user.c
+++ b/drivers/staging/vme/devices/vme_user.c
@@ -829,8 +829,8 @@ err_master:
 err_slave:
 	while (i > SLAVE_MINOR) {
 		i--;
-		vme_slave_free(image[i].resource);
 		buf_unalloc(i);
+		vme_slave_free(image[i].resource);
 	}
 err_class:
 	cdev_del(vme_user_cdev);
@@ -855,8 +855,8 @@ static int __exit vme_user_remove(struct device *dev, int cur_bus, int cur_slot)
 
 	for (i = SLAVE_MINOR; i < (SLAVE_MAX + 1); i++) {
 		vme_slave_set(image[i].resource, 0, 0, 0, 0, VME_A32, 0);
-		vme_slave_free(image[i].resource);
 		buf_unalloc(i);
+		vme_slave_free(image[i].resource);
 	}
 
 	/* Unregister device driver */


--
Martyn Welch (Principal Software Engineer)   |   Registered in England and
GE Intelligent Platforms                     |   Wales (3828642) at 100
T +44(0)127322748                            |   Barbirolli Square, Manchester,
E martyn.welch@...com                        |   M2 3AB  VAT:GB 927559189
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/