lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <alpine.LNX.2.00.1102062128391.13593@swampdragon.chaosbits.net>
Date:	Sun, 6 Feb 2011 21:33:50 +0100 (CET)
From:	Jesper Juhl <jj@...osbits.net>
To:	linux-kernel@...r.kernel.org
cc:	linux-media@...r.kernel.org, Dan Carpenter <error27@...il.com>,
	Tejun Heo <tj@...nel.org>,
	Matthias Schwarzott <zzam@...too.org>,
	Mauro Carvalho Chehab <mchehab@...radead.org>
Subject: [Patch] Zarlink zl10036 DVB-S: Fix mem leak in zl10036_attach

If the memory allocation to 'state' succeeds but we jump to the 'error' 
label before 'state' is assigned to fe->tuner_priv, then the call to 
'zl10036_release(fe)' at the 'error:' label will not free 'state', but 
only what was previously assigned to 'tuner_priv', thus leaking the memory 
allocated to 'state'.
There are may ways to fix this, including assigning the allocated memory 
directly to 'fe->tuner_priv', but I did not go for that since the 
additional pointer derefs are more expensive than the local variable, so I 
just added a 'kfree(state)' call. I guess the call to 'zl10036_release' 
might not even be needed in this case, but I wasn't sure, so I left it in.

Signed-off-by: Jesper Juhl <jj@...osbits.net>
---
 zl10036.c |    1 +
 1 file changed, 1 insertion(+)

 compile tested only.

diff --git a/drivers/media/dvb/frontends/zl10036.c b/drivers/media/dvb/frontends/zl10036.c
index 4627f49..b4fb8e8 100644
--- a/drivers/media/dvb/frontends/zl10036.c
+++ b/drivers/media/dvb/frontends/zl10036.c
@@ -508,6 +508,7 @@ struct dvb_frontend *zl10036_attach(struct dvb_frontend *fe,
 
 error:
 	zl10036_release(fe);
+	kfree(state);
 	return NULL;
 }
 EXPORT_SYMBOL(zl10036_attach);


-- 
Jesper Juhl <jj@...osbits.net>            http://www.chaosbits.net/
Plain text mails only, please.
Don't top-post http://www.catb.org/~esr/jargon/html/T/top-post.html

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ