From patchwork Tue Dec 22 20:31:23 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Julia Lawall X-Patchwork-Id: 2357 Return-path: Envelope-to: mchehab@infradead.org Delivery-date: Tue, 22 Dec 2009 20:33:29 +0000 Received: from bombadil.infradead.org [18.85.46.34] by gaivota.chehab.org with IMAP (fetchmail-6.3.11) for (single-drop); Tue, 22 Dec 2009 21:57:33 -0200 (BRST) Received: from vger.kernel.org ([209.132.180.67]) by bombadil.infradead.org with esmtp (Exim 4.69 #1 (Red Hat Linux)) id 1NNBQ9-0000cd-0p; Tue, 22 Dec 2009 20:33:29 +0000 Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754531AbZLVUb1 (ORCPT + 1 other); Tue, 22 Dec 2009 15:31:27 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1754428AbZLVUb1 (ORCPT ); Tue, 22 Dec 2009 15:31:27 -0500 Received: from mgw2.diku.dk ([130.225.96.92]:43106 "EHLO mgw2.diku.dk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754345AbZLVUbZ (ORCPT ); Tue, 22 Dec 2009 15:31:25 -0500 Received: from localhost (localhost [127.0.0.1]) by mgw2.diku.dk (Postfix) with ESMTP id 9E6C819BBD2; Tue, 22 Dec 2009 21:31:24 +0100 (CET) Received: from mgw2.diku.dk ([127.0.0.1]) by localhost (mgw2.diku.dk [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 10721-05; Tue, 22 Dec 2009 21:31:23 +0100 (CET) Received: from nhugin.diku.dk (nhugin.diku.dk [130.225.96.140]) by mgw2.diku.dk (Postfix) with ESMTP id 65E6A19BBCF; Tue, 22 Dec 2009 21:31:23 +0100 (CET) Received: from ask.diku.dk (ask.diku.dk [130.225.96.225]) by nhugin.diku.dk (Postfix) with ESMTP id BF5BA6DF893; Tue, 22 Dec 2009 21:27:19 +0100 (CET) Received: by ask.diku.dk (Postfix, from userid 3767) id 4FBBE49CE; Tue, 22 Dec 2009 21:31:23 +0100 (CET) Received: from localhost (localhost [127.0.0.1]) by ask.diku.dk (Postfix) with ESMTP id 4798248CF; Tue, 22 Dec 2009 21:31:23 +0100 (CET) Date: Tue, 22 Dec 2009 21:31:23 +0100 (CET) From: Julia Lawall To: Mauro Carvalho Chehab , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org Subject: [PATCH 2/6] drivers/media/radio: Correct use after free Message-ID: MIME-Version: 1.0 X-Virus-Scanned: amavisd-new at diku.dk Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org From: Julia Lawall It is not clear how to share the unlock in the case where the structure containing the lock has to be freed. So the unlock is now duplicated, with one copy moved before the free. The unlock label furthermore is no longer useful and is thus deleted. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // @@ expression x,e; identifier f; iterator I; statement S; @@ *kfree(x); ... when != &x when != x = e when != I(x,...) S *x->f // Signed-off-by: Julia Lawall --- drivers/media/radio/si470x/radio-si470x-usb.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe linux-media" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/drivers/media/radio/si470x/radio-si470x-usb.c b/drivers/media/radio/si470x/radio-si470x-usb.c index a96e1b9..a0a79c7 100644 --- a/drivers/media/radio/si470x/radio-si470x-usb.c +++ b/drivers/media/radio/si470x/radio-si470x-usb.c @@ -590,8 +590,9 @@ int si470x_fops_release(struct file *file) video_unregister_device(radio->videodev); kfree(radio->int_in_buffer); kfree(radio->buffer); + mutex_unlock(&radio->disconnect_lock); kfree(radio); - goto unlock; + goto done; } /* cancel read processes */ @@ -601,7 +602,6 @@ int si470x_fops_release(struct file *file) retval = si470x_stop(radio); usb_autopm_put_interface(radio->intf); } -unlock: mutex_unlock(&radio->disconnect_lock); done: return retval;