diff options
author | Cihangir Akturk <cakturk@gmail.com> | 2017-08-07 13:43:00 +0300 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2017-08-18 17:16:51 -0700 |
commit | 0de79ffc09a2d28640b4b3d9129080da5646ef25 (patch) | |
tree | 476488cb5b74d7618ca5f09337744cbb8a3e8a88 /drivers/iio/light | |
parent | bab87505c3284ac3345463abb8af9e6774e7e9f8 (diff) | |
download | op-kernel-dev-0de79ffc09a2d28640b4b3d9129080da5646ef25.zip op-kernel-dev-0de79ffc09a2d28640b4b3d9129080da5646ef25.tar.gz |
staging: lustre: mgc: fix potential use after free in error path
The config_log_add() function first calls config_log_put() with the
variable 'cld' and then jumps to label 'out_cld', which will call
the same function with the same 'cld' variable. However, at this
point, 'cld' might have been already freed by the first invocation
of config_log_put(). Even if we remove the invocation at that point,
we will still get into trouble. This is because, in the error path,
just below the label 'out_cld', we try to put 'params_cls' and
'sptlrpc_cld', which might also have been freed by config_log_put().
The point is that, config_llog_data::cld_sptlrpc and
config_llog_data::cld_params members are assigned at the beginning
of this function.
To avoid this, do not call config_log_put() inside the else block,
immediately jump to 'out_cld' instead. Moreover, remove assignments
to config_llog_data::cld_sptlrpc and config_llog_data::cld_params at
the beginning, since we already assign them below in the function
with 'cld_lock' held.
As an additional benefit, code size gets smaller.
before:
text data bss dec hex filename
26188 2256 4208 32652 7f8c drivers/staging/lustre/lustre/mgc/mgc_request.o
after:
text data bss dec hex filename
26092 2256 4208 32556 7f2c drivers/staging/lustre/lustre/mgc/mgc_request.o
Signed-off-by: Cihangir Akturk <cakturk@gmail.com>
Reviewed-by: James Simmons <jsimmons@infradead.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/iio/light')
0 files changed, 0 insertions, 0 deletions