linux-kernel - [Patch] Zarlink zl10036 DVB-S: Fix mem leak in zl10036

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.LNX.2.00.1102062128391.13593@swampdragon.chaosbits.net>
Date:	Sun, 6 Feb 2011 21:33:50 +0100 (CET)
From:	Jesper Juhl <jj@...osbits.net>
To:	linux-kernel@...r.kernel.org
cc:	linux-media@...r.kernel.org, Dan Carpenter <error27@...il.com>,
	Tejun Heo <tj@...nel.org>,
	Matthias Schwarzott <zzam@...too.org>,
	Mauro Carvalho Chehab <mchehab@...radead.org>
Subject: [Patch] Zarlink zl10036 DVB-S: Fix mem leak in zl10036_attach

If the memory allocation to 'state' succeeds but we jump to the 'error' 
label before 'state' is assigned to fe->tuner_priv, then the call to 
'zl10036_release(fe)' at the 'error:' label will not free 'state', but 
only what was previously assigned to 'tuner_priv', thus leaking the memory 
allocated to 'state'.
There are may ways to fix this, including assigning the allocated memory 
directly to 'fe->tuner_priv', but I did not go for that since the 
additional pointer derefs are more expensive than the local variable, so I 
just added a 'kfree(state)' call. I guess the call to 'zl10036_release' 
might not even be needed in this case, but I wasn't sure, so I left it in.

Signed-off-by: Jesper Juhl <jj@...osbits.net>
---
 zl10036.c |    1 +
 1 file changed, 1 insertion(+)

 compile tested only.

diff --git a/drivers/media/dvb/frontends/zl10036.c b/drivers/media/dvb/frontends/zl10036.c
index 4627f49..b4fb8e8 100644
--- a/drivers/media/dvb/frontends/zl10036.c
+++ b/drivers/media/dvb/frontends/zl10036.c
@@ -508,6 +508,7 @@ struct dvb_frontend *zl10036_attach(struct dvb_frontend *fe,

 error:
 	zl10036_release(fe);
+	kfree(state);
 	return NULL;
 }
 EXPORT_SYMBOL(zl10036_attach);

-- 
Jesper Juhl <jj@...osbits.net>            http://www.chaosbits.net/
Plain text mails only, please.
Don't top-post http://www.catb.org/~esr/jargon/html/T/top-post.html

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/