linux-kernel - [PATCH][Trivial] Media, DVB, Siano, smsusb: Avoid static analysis report about 'use after free'.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <alpine.LNX.2.00.1104212303220.4159@swampdragon.chaosbits.net>
Date:	Thu, 21 Apr 2011 23:11:25 +0200 (CEST)
From:	Jesper Juhl <jj@...osbits.net>
To:	linux-media@...r.kernel.org
cc:	trivial@...nel.org, linux-kernel@...r.kernel.org,
	Mauro Carvalho Chehab <mchehab@...radead.org>,
	Joe Perches <joe@...ches.com>
Subject: [PATCH][Trivial] Media, DVB, Siano, smsusb: Avoid static analysis
 report about 'use after free'.

In drivers/media/dvb/siano/smsusb.c we have this code:
 ...
               kfree(dev);

               sms_info("device %p destroyed", dev);
 ...

at least one static analysis tool (Coverity Prevent) complains about this 
as a use-after-free bug.
While it's true that we do use the pointer variable after freeing it, the 
only use is to print the value of the pointer, so there's not actually any 
problem here. But still, silencing the complaint is trivial by just moving 
the kfree() call below the sms_info(), so why not just do it?. It doesn't 
change the workings of the code in any way, but it makes the tool shut up. 
The patch below also removes a rather pointless blank line.

Signed-off-by: Jesper Juhl <jj@...osbits.net>
---
 smsusb.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/media/dvb/siano/smsusb.c b/drivers/media/dvb/siano/smsusb.c
index 0b8da57..0c8164a 100644
--- a/drivers/media/dvb/siano/smsusb.c
+++ b/drivers/media/dvb/siano/smsusb.c
@@ -297,9 +297,8 @@ static void smsusb_term_device(struct usb_interface *intf)
 		if (dev->coredev)
 			smscore_unregister_device(dev->coredev);
 
-		kfree(dev);
-
 		sms_info("device %p destroyed", dev);
+		kfree(dev);
 	}
 
 	usb_set_intfdata(intf, NULL);


-- 
Jesper Juhl <jj@...osbits.net>       http://www.chaosbits.net/
Don't top-post http://www.catb.org/jargon/html/T/top-post.html
Plain text mails only, please.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/