lguest: dereferencing freed mem in add_eventfd()
authorDan Carpenter <error27@gmail.com>
Sun, 19 Jul 2009 11:46:09 +0000 (14:46 +0300)
committerRusty Russell <rusty@rustcorp.com.au>
Thu, 30 Jul 2009 06:33:43 +0000 (16:03 +0930)
"new" was freed and then dereferenced.  Also the return value wasn't being
used so I modified the caller as well.

Compile tested only.  Found by smatch (http://repo.or.cz/w/smatch.git).

regards,
dan carpenter

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
drivers/lguest/lguest_user.c

index 9f9a2953b3830dd42b9f1eb1f06649ed9870e5e3..407722a8e0c45868b04b009bcb25e01b0c07ed3a 100644 (file)
@@ -52,8 +52,9 @@ static int add_eventfd(struct lguest *lg, unsigned long addr, int fd)
        new->map[new->num].addr = addr;
        new->map[new->num].event = eventfd_ctx_fdget(fd);
        if (IS_ERR(new->map[new->num].event)) {
+               int err =  PTR_ERR(new->map[new->num].event);
                kfree(new);
-               return PTR_ERR(new->map[new->num].event);
+               return err;
        }
        new->num++;
 
@@ -83,7 +84,7 @@ static int attach_eventfd(struct lguest *lg, const unsigned long __user *input)
        err = add_eventfd(lg, addr, fd);
        mutex_unlock(&lguest_lock);
 
-       return 0;
+       return err;
 }
 
 /*L:050 Sending an interrupt is done by writing LHREQ_IRQ and an interrupt