linux-kernel - [RFT] media: hdpvr: Fix Double kfree() error

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <ed0e67f9c56e42827f34d6e2991e6572070f8996.1521544143.git.arvind.yadav.cs@gmail.com>
Date:   Tue, 20 Mar 2018 16:46:39 +0530
From:   Arvind Yadav <arvind.yadav.cs@...il.com>
To:     hverkuil@...all.nl, mchehab@...nel.org,
        laurent.pinchart@...asonboard.com, sean@...s.org,
        gregkh@...uxfoundation.org, andreyknvl@...gle.com,
        hans.verkuil@...co.com
Cc:     linux-kernel@...r.kernel.org, linux-media@...r.kernel.org
Subject: [RFT] media: hdpvr: Fix Double kfree() error

Here, double-free is happening on error path of hdpvr_probe.

error_v4l2_unregister:
  v4l2_device_unregister(&dev->v4l2_dev);
   =>
    v4l2_device_disconnect
    =>
     put_device
     =>
      kobject_put
      =>
       kref_put
       =>
        v4l2_device_release
        =>
         hdpvr_device_release (CALLBACK)
         =>
         kfree(dev)

error_free_dev:
           kfree(dev)

Signed-off-by: Arvind Yadav <arvind.yadav.cs@...il.com>
---
reported by:
           Dan Carpenter<dan.carpenter@...cle.com>

 drivers/media/usb/hdpvr/hdpvr-core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/usb/hdpvr/hdpvr-core.c b/drivers/media/usb/hdpvr/hdpvr-core.c
index 29ac7fc..cab100a0 100644
--- a/drivers/media/usb/hdpvr/hdpvr-core.c
+++ b/drivers/media/usb/hdpvr/hdpvr-core.c
@@ -395,6 +395,7 @@ static int hdpvr_probe(struct usb_interface *interface,
 	kfree(dev->usbc_buf);
 error_v4l2_unregister:
 	v4l2_device_unregister(&dev->v4l2_dev);
+	dev = NULL;
 error_free_dev:
 	kfree(dev);
 error:
-- 
1.9.1