Re: [PATCH] Fix a use after free bug in kernel->userspace relay file support

2007-07-19 Thread Mathieu Desnoyers
* Andrew Morton ([EMAIL PROTECTED]) wrote: > On Thu, 19 Jul 2007 21:09:09 -0400 > Mathieu Desnoyers <[EMAIL PROTECTED]> wrote: > > > Coverity spotted what looks like a real possible case of using a > > variable after it has been freed. > > The problem is in kernel/relay.c::relay_open_buf() > > >

Re: [PATCH] Fix a use after free bug in kernel->userspace relay file support

2007-07-19 Thread Andrew Morton
On Thu, 19 Jul 2007 21:09:09 -0400 Mathieu Desnoyers <[EMAIL PROTECTED]> wrote: > Coverity spotted what looks like a real possible case of using a > variable after it has been freed. > The problem is in kernel/relay.c::relay_open_buf() > > If the code hits "goto free_buf;" it ends up in this cod

[PATCH] Fix a use after free bug in kernel->userspace relay file support

2007-07-19 Thread Mathieu Desnoyers
Coverity spotted what looks like a real possible case of using a variable after it has been freed. The problem is in kernel/relay.c::relay_open_buf() If the code hits "goto free_buf;" it ends up in this code : free_buf: relay_destroy_buf(buf); <--- calls kfree() on 'buf'. free_name:

Re: [PATCH] Fix a use after free bug in kernel->userspace relay file support

2007-07-19 Thread Jesper Juhl
On 19/07/07, David J. Wilder <[EMAIL PROTECTED]> wrote: ACK Thanks for catching this. Your patch looks fine. I tested for regression, no problems. I also tested the error path and had the expected results. Ok, thank you for testing. I see that Mathieu Desnoyers also ack'ed the patch (thank you

Re: [PATCH] Fix a use after free bug in kernel->userspace relay file support

2007-07-19 Thread Mathieu Desnoyers
* Jesper Juhl ([EMAIL PROTECTED]) wrote: > Hi, > > Coverity spotted what looks like a real possible case of using a > variable after it has been freed. > The problem is in kernel/relay.c::relay_open_buf() > > If the code hits "goto free_buf;" it ends up in this code : > > free_buf: > re

Re: [PATCH] Fix a use after free bug in kernel->userspace relay file support

2007-07-19 Thread David J. Wilder
ACK Thanks for catching this. Your patch looks fine. I tested for regression, no problems. I also tested the error path and had the expected results. Thanks Dave Jesper Juhl wrote: Hi, Coverity spotted what looks like a real possible case of using a variable after it has been freed. The pr

[PATCH] Fix a use after free bug in kernel->userspace relay file support

2007-07-18 Thread Jesper Juhl
Hi, Coverity spotted what looks like a real possible case of using a variable after it has been freed. The problem is in kernel/relay.c::relay_open_buf() If the code hits "goto free_buf;" it ends up in this code : free_buf: relay_destroy_buf(buf); <--- calls kfree() on 'buf'. free_n