linux-kernel - Re: [PATCH 1/1] media: si470x-i2c: Move free() past last use of 'radio'

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 3 Feb 2020 14:58:31 +0000
From:   Greg KH <greg@...ah.com>
To:     Lee Jones <lee.jones@...aro.org>
Cc:     stable@...r.kernel.org, linux-arm-kernel@...ts.infradead.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH 1/1] media: si470x-i2c: Move free() past last use of
 'radio'

On Mon, Feb 03, 2020 at 02:32:45PM +0000, Greg KH wrote:
> On Mon, Feb 03, 2020 at 01:21:30PM +0000, Lee Jones wrote:
> > A pointer to 'struct si470x_device' is currently used after free:
> > 
> >   drivers/media/radio/si470x/radio-si470x-i2c.c:462:25-30: ERROR: reference
> >     preceded by free on line 460
> > 
> > Shift the call to free() down past its final use.
> > 
> > NB: Not sending to Mainline, since the problem does not exist there.
> 
> It doesn't exist there because of a bad merge?  What commit caused the
> problem?

Ah, found it, it was 2df200ab234a ("media: si470x-i2c: add missed
operations in remove")