linux-kernel - Re: [PATCH 1/5] sound/isa/opti9xx/miro.c: eliminate possible double free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <s5h4nloj9w1.wl%tiwai@suse.de>
Date:	Sun, 21 Oct 2012 14:18:54 +0200
From:	Takashi Iwai <tiwai@...e.de>
To:	Julia Lawall <Julia.Lawall@...6.fr>
Cc:	Jaroslav Kysela <perex@...ex.cz>, kernel-janitors@...r.kernel.org,
	alsa-devel@...a-project.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 1/5] sound/isa/opti9xx/miro.c: eliminate possible double free

At Sun, 21 Oct 2012 12:52:03 +0200,
Julia Lawall wrote:
> 
> From: Julia Lawall <Julia.Lawall@...6.fr>
> 
> snd_miro_probe is a static function that is only called twice in the file
> that defines it.  At each call site, its argument is freed using
> snd_card_free.  Thus, there is no need for snd_miro_probe to call
> snd_card_free on its argument on any of its error exit paths.
> 
> Because snd_card_free both reads the fields of its argument and kfrees its
> argments, the results of the second snd_card_free should be unpredictable.
> 
> A simplified version of the semantic match that finds this problem is as
> follows: (http://coccinelle.lip6.fr/)
> 
> // <smpl>
> @r@
> identifier f,free,a;
> parameter list[n] ps;
> type T;
> expression e;
> @@
> 
> f(ps,T a,...) {
>   ... when any
>       when != a = e
>   if(...) { ... free(a); ... return ...; }
>   ... when any
> }
> 
> @@
> identifier r.f,r.free;
> expression x,a;
> expression list[r.n] xs;
> @@
> 
> * x = f(xs,a,...);
>   if (...) { ... free(a); ... return ...; }
> // </smpl>
> 
> Signed-off-by: Julia Lawall <Julia.Lawall@...6.fr>

Thanks, applied.


Takashi

> 
> ---
> Not tested.
> 
>  sound/isa/opti9xx/miro.c |    1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/sound/isa/opti9xx/miro.c b/sound/isa/opti9xx/miro.c
> index 3d1afb6..4a7ff4e 100644
> --- a/sound/isa/opti9xx/miro.c
> +++ b/sound/isa/opti9xx/miro.c
> @@ -1286,7 +1286,6 @@ static int __devinit snd_miro_probe(struct snd_card *card)
>  
>  	error = snd_card_miro_aci_detect(card, miro);
>  	if (error < 0) {
> -		snd_card_free(card);
>  		snd_printk(KERN_ERR "unable to detect aci chip\n");
>  		return -ENODEV;
>  	}
> 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/