AuxXxilium/linux_dsm_epyc7002
1
0
Fork 0
mirror of https://github.com/AuxXxilium/linux_dsm_epyc7002.git synced 2024-11-25 23:30:53 +07:00
Code Issues Actions Packages Projects Releases Wiki Activity

lguest: dereferencing freed mem in add_eventfd()

Browse Source 
"new" was freed and then dereferenced.  Also the return value wasn't being
used so I modified the caller as well.

Compile tested only.  Found by smatch (http://repo.or.cz/w/smatch.git).

regards,
dan carpenter

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit is contained in:
Dan Carpenter 2009-07-19 14:46:09 +03:00 committed by Rusty Russell
parent 658874f05d
commit f294526279
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/lguest/lguest_user.c
View File

@ -52,8 +52,9 @@ static int add_eventfd(struct lguest *lg, unsigned long addr, int fd)
new->map[new->num].addr = addr;
new->map[new->num].event = eventfd_ctx_fdget(fd);
if (IS_ERR(new->map[new->num].event)) {
int err = PTR_ERR(new->map[new->num].event);
kfree(new);
return PTR_ERR(new->map[new->num].event);
return err;
}
new->num++;
@ -83,7 +84,7 @@ static int attach_eventfd(struct lguest *lg, const unsigned long __user *input)
err = add_eventfd(lg, addr, fd);
mutex_unlock(&lguest_lock);
return 0;
return err;
}
/*L:050 Sending an interrupt is done by writing LHREQ_IRQ and an interrupt