Skip to contentSkip to conversation

xenbus_xs.c: use-after-free

PATCH In review Adrian Bunk 2 participants 3 messages Jul 23, 2007 Xen hypervisor interface

lore
Share & tools
lore
#0 lore raw

The Coverity checker spotted the following use-after-free in drivers/xen/xenbus/xenbus_xs.c:

<-- snip -->

...
static int process_msg(void)
{
...

                if (IS_ERR(msg->u.watch.vec)) {
                        kfree(msg);
                        err = PTR_ERR(msg->u.watch.vec);

...

<-- snip -->

cu
Adrian

Signature · 4 lines
       "Is there not promise of rain?" Ling Tan asked suddenly out
        of the darkness. There had been need of rain for many days.
       "Only a promise," Lao Er said.
                                       Pearl S. Buck - Dragon Seed
#1 lore raw

PATCH 1/1 xenbus_xs.c: fix a use-after-free

This patch fixes an obvious use-after-free spotted by the Coverity checker.

---

drivers/xen/xenbus/xenbus_xs.c renamed from drivers/xen/xenbus/xenbus_xs.c.old +1 -1
@@ -782,8 +782,8 @@ static int process_msg(void)
 		msg->u.watch.vec = split(body, msg->hdr.len,
 					 &msg->u.watch.vec_size);
 		if (IS_ERR(msg->u.watch.vec)) {
-			kfree(msg);
 			err = PTR_ERR(msg->u.watch.vec);
+			kfree(msg);
 			goto out;
 		}