Commit c9b3febc authored by Jesper Juhl's avatar Jesper Juhl Committed by Linus Torvalds
Browse files

Fix a use after free bug in kernel->userspace relay file support

Coverity spotted what looks like a real possible case of using a variable
after it has been freed.  The problem is in

If the code hits "goto free_buf;" it ends up in this code :

    	relay_destroy_buf(buf);	<--- calls kfree() on 'buf'.
  	return buf;		<-- use after free of 'buf'.

I read through the callers and they all handle a NULL return from this
function as an error (and hitting the 'free_buf' label only happens on
failure to chan->cb->create_buf_file(), so that looks like a clear error to

The patch simply sets 'buf' to NULL after the call to
relay_destroy_buf(buf); - as far as I can see that should take care of the

The patch also corrects a reference to a documentation file while
I was at it.

Note from Mathieu: the documentation reference change should have been
done in a separate patch, but I guess no one will really care.
Signed-off-by: default avatarJesper Juhl <>
Acked-by: default avatar"David J. Wilder" <>
Tested-by: default avatar"David J. Wilder" <>
Signed-off-by: default avatarMathieu Desnoyers <>
Cc: Tom Zanussi <>
Cc: Karim Yaghmour <>
Signed-off-by: default avatarAndrew Morton <>
Signed-off-by: default avatarLinus Torvalds <>
parent e804a4a4
* Public API and common code for kernel->userspace relay file support.
* See Documentation/filesystems/relayfs.txt for an overview of relayfs.
* See Documentation/filesystems/relay.txt for an overview.
* Copyright (C) 2002-2005 - Tom Zanussi (, IBM Corp
* Copyright (C) 1999-2005 - Karim Yaghmour (
......@@ -426,6 +426,7 @@ static struct rchan_buf *relay_open_buf(struct rchan *chan, unsigned int cpu)
buf = NULL;
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment