aboutsummaryrefslogtreecommitdiff
path: root/drivers/virtio
diff options
context:
space:
mode:
authorJulia Lawall <julia@diku.dk>2010-05-15 11:45:53 +0200
committerRusty Russell <rusty@rustcorp.com.au>2010-05-19 22:15:51 +0930
commit0643e4c6e4fd67778fa886a89e6ec2320e0ff4d3 (patch)
treeb56c3f7112a36694c133417c68c3f9283a42f713 /drivers/virtio
parent8345adbf96fc1bde7d9846aadbe5af9b2ae90882 (diff)
drivers/char: Eliminate use after free
In each case, the first argument to send_control_msg or __send_control_msg, respectively, has either not been successfully allocated or has been freed at the point of the call. In the first case, the first argument, port, is only used to access the portdev and id fields, in order to call __send_control_msg. Thus it seems possible instead to call __send_control_msg directly. In the second case, the call to __send_control_msg is moved up to a place where it seems like the first argument, portdev, has been initialized sufficiently to make the call to __send_control_msg meaningful. This has only been compile tested. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> @free@ expression E; position p; @@ kfree@p(E) @@ expression free.E, subE<=free.E, E1; position free.p; @@ kfree@p(E) ... ( subE = E1 | * E ) // </smpl> Signed-off-by: Julia Lawall <julia@diku.dk> Acked-by: Amit Shah <amit.shah@redhat.com> Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Diffstat (limited to 'drivers/virtio')
0 files changed, 0 insertions, 0 deletions