* [patch] NFC: use after free on error
@ 2011-09-23 6:14 ` Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2011-09-23 6:14 UTC (permalink / raw)
To: Lauro Ramos Venancio
Cc: Aloisio Almeida Jr, Samuel Ortiz, John W. Linville, Ilan Elias,
linux-wireless, kernel-janitors
We returned a freed variable on some error paths when the intent was
to return a NULL. Part of the reason this was missed was that the
code was confusing because it had too many gotos so I removed them
and simplified the flow a bit.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
index 895e5fd..06330cd 100644
--- a/net/nfc/nci/core.c
+++ b/net/nfc/nci/core.c
@@ -490,19 +490,19 @@ struct nci_dev *nci_allocate_device(struct nci_ops *ops,
int tx_headroom,
int tx_tailroom)
{
- struct nci_dev *ndev = NULL;
+ struct nci_dev *ndev;
nfc_dbg("entry, supported_protocols 0x%x", supported_protocols);
if (!ops->open || !ops->close || !ops->send)
- goto exit;
+ return NULL;
if (!supported_protocols)
- goto exit;
+ return NULL;
ndev = kzalloc(sizeof(struct nci_dev), GFP_KERNEL);
if (!ndev)
- goto exit;
+ return NULL;
ndev->ops = ops;
ndev->tx_headroom = tx_headroom;
@@ -517,13 +517,11 @@ struct nci_dev *nci_allocate_device(struct nci_ops *ops,
nfc_set_drvdata(ndev->nfc_dev, ndev);
- goto exit;
+ return ndev;
free_exit:
kfree(ndev);
-
-exit:
- return ndev;
+ return NULL;
}
EXPORT_SYMBOL(nci_allocate_device);
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [patch] NFC: use after free on error
@ 2011-09-23 6:14 ` Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2011-09-23 6:14 UTC (permalink / raw)
To: Lauro Ramos Venancio
Cc: Aloisio Almeida Jr, Samuel Ortiz, John W. Linville, Ilan Elias,
linux-wireless, kernel-janitors
We returned a freed variable on some error paths when the intent was
to return a NULL. Part of the reason this was missed was that the
code was confusing because it had too many gotos so I removed them
and simplified the flow a bit.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
index 895e5fd..06330cd 100644
--- a/net/nfc/nci/core.c
+++ b/net/nfc/nci/core.c
@@ -490,19 +490,19 @@ struct nci_dev *nci_allocate_device(struct nci_ops *ops,
int tx_headroom,
int tx_tailroom)
{
- struct nci_dev *ndev = NULL;
+ struct nci_dev *ndev;
nfc_dbg("entry, supported_protocols 0x%x", supported_protocols);
if (!ops->open || !ops->close || !ops->send)
- goto exit;
+ return NULL;
if (!supported_protocols)
- goto exit;
+ return NULL;
ndev = kzalloc(sizeof(struct nci_dev), GFP_KERNEL);
if (!ndev)
- goto exit;
+ return NULL;
ndev->ops = ops;
ndev->tx_headroom = tx_headroom;
@@ -517,13 +517,11 @@ struct nci_dev *nci_allocate_device(struct nci_ops *ops,
nfc_set_drvdata(ndev->nfc_dev, ndev);
- goto exit;
+ return ndev;
free_exit:
kfree(ndev);
-
-exit:
- return ndev;
+ return NULL;
}
EXPORT_SYMBOL(nci_allocate_device);
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [patch] NFC: use after free on error
2011-09-23 6:14 ` Dan Carpenter
@ 2011-09-26 21:08 ` Lauro Ramos Venancio
-1 siblings, 0 replies; 4+ messages in thread
From: Lauro Ramos Venancio @ 2011-09-26 21:08 UTC (permalink / raw)
To: Dan Carpenter
Cc: Aloisio Almeida Jr, Samuel Ortiz, John W. Linville, Ilan Elias,
linux-wireless, kernel-janitors
2011/9/23 Dan Carpenter <dan.carpenter@oracle.com>:
> We returned a freed variable on some error paths when the intent was
> to return a NULL. Part of the reason this was missed was that the
> code was confusing because it had too many gotos so I removed them
> and simplified the flow a bit.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Lauro Ramos Venancio <lauro.venancio@openbossa.org>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [patch] NFC: use after free on error
@ 2011-09-26 21:08 ` Lauro Ramos Venancio
0 siblings, 0 replies; 4+ messages in thread
From: Lauro Ramos Venancio @ 2011-09-26 21:08 UTC (permalink / raw)
To: Dan Carpenter
Cc: Aloisio Almeida Jr, Samuel Ortiz, John W. Linville, Ilan Elias,
linux-wireless, kernel-janitors
2011/9/23 Dan Carpenter <dan.carpenter@oracle.com>:
> We returned a freed variable on some error paths when the intent was
> to return a NULL. Â Part of the reason this was missed was that the
> code was confusing because it had too many gotos so I removed them
> and simplified the flow a bit.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Lauro Ramos Venancio <lauro.venancio@openbossa.org>
--
To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2011-09-26 21:08 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2011-09-23 6:14 [patch] NFC: use after free on error Dan Carpenter
2011-09-23 6:14 ` Dan Carpenter
2011-09-26 21:08 ` Lauro Ramos Venancio
2011-09-26 21:08 ` Lauro Ramos Venancio
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.