linux/drivers
Jesper Juhl bdc3e603cd fix use after free in amd create gatt pages
Coverity spotted a "use after free" bug in
drivers/char/agp/amd-k7-agp.c::amd_create_gatt_pages().

The problem is this:
	If "entry = kzalloc(sizeof(struct amd_page_map), GFP_KERNEL);"
fails, then there's a loop in the function to free all entries
allocated so far and break out of the allocation loop. That in itself
is pretty sane, but then the (now freed) 'tables' is assigned to
amd_irongate_private.gatt_pages and 'retval' is set to -ENOMEM which
causes amd_free_gatt_pages(); to be called at the end of the function.
The problem with this is that amd_free_gatt_pages() will then loop
'amd_irongate_private.num_tables' times and try to free each entry in
tables[] - this is bad since tables has already been freed and
furthermore it will call kfree(tables) at the end - a double free.

This patch removes the freeing loop in amd_create_gatt_pages() and
instead relies entirely on the call to amd_free_gatt_pages() to free
everything we allocated in case of an error. It also sets
amd_irongate_private.num_tables to the actual number of entries
allocated instead of just using the value passed in from the caller -
this ensures that amd_free_gatt_pages() will only attempt to free
stuff that was actually allocated.

Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2007-10-15 10:32:15 +10:00
..
acorn/char
acpi more trivial signedness fixes in drivers 2007-10-14 12:41:52 -07:00
amba Driver core: change add_uevent_var to use a struct 2007-10-12 14:51:01 -07:00
ata more trivial signedness fixes in drivers 2007-10-14 12:41:52 -07:00
atm more trivial signedness fixes in drivers 2007-10-14 12:41:52 -07:00
auxdisplay
base more uevent fallout (drivers/base/memory.c) 2007-10-14 08:53:33 -07:00
block more trivial signedness fixes in drivers 2007-10-14 12:41:52 -07:00
bluetooth
cdrom [POWERPC] iSeries: Move detection of virtual cdroms 2007-10-11 20:40:47 +10:00
char fix use after free in amd create gatt pages 2007-10-15 10:32:15 +10:00
clocksource
connector [NET]: make netlink user -> kernel interface synchronious 2007-10-10 21:15:29 -07:00
cpufreq Merge master.kernel.org:/pub/scm/linux/kernel/git/gregkh/driver-2.6 2007-10-12 15:49:37 -07:00
crypto [CRYPTO] sha: Add header file for SHA definitions 2007-10-10 16:55:50 -07:00
dio
dma
edac Drivers: clean up direct setting of the name of a kset 2007-10-12 14:51:02 -07:00
eisa signedness: module_param_array nump argument 2007-10-14 12:41:52 -07:00
fc4 long vs. unsigned long - low-hanging fruits in drivers 2007-10-14 12:41:51 -07:00
firewire fw-cdev __user annotations 2007-10-14 12:41:51 -07:00
firmware Driver core: rename ktype_edd and ktype_efivar 2007-10-12 14:51:12 -07:00
hid more trivial signedness fixes in drivers 2007-10-14 12:41:52 -07:00
hwmon Merge branch 'release' of git://lm-sensors.org/kernel/mhoffman/hwmon-2.6 2007-10-14 12:50:19 -07:00
i2c i2c-nforce2: Declare PEC as supported 2007-10-13 23:56:33 +02:00
ide alim15x3: remove redundant m5229_revision check 2007-10-13 17:47:53 +02:00
ieee1394 Driver core: change add_uevent_var to use a struct 2007-10-12 14:51:01 -07:00
infiniband Driver core: change add_uevent_var to use a struct 2007-10-12 14:51:01 -07:00
input Merge branch 'release' of git://lm-sensors.org/kernel/mhoffman/hwmon-2.6 2007-10-14 12:50:19 -07:00
isdn hisax: hfc_usb: update to current CVS version 2007-10-14 12:45:14 -07:00
kvm KVM: Skip pio instruction when it is emulated, not executed 2007-10-13 10:18:29 +02:00
leds leds: Update Cobalt Qube series front LED support 2007-10-11 22:24:00 +01:00
lguest
macintosh
mca
md dm: emc_endio returns void 2007-10-13 09:41:03 -07:00
media signedness: module_param_array nump argument 2007-10-14 12:41:52 -07:00
message [NET]: Nuke SET_MODULE_OWNER macro. 2007-10-10 16:51:13 -07:00
mfd
misc Merge branch 'release' of git://lm-sensors.org/kernel/mhoffman/hwmon-2.6 2007-10-14 12:50:19 -07:00
mmc Fix compile while compiling drivers/mmc/host/mmc_spi.o with !BLOCK 2007-10-14 16:48:52 -07:00
mtd signedness: module_param_array nump argument 2007-10-14 12:41:52 -07:00
net sky2: reboot fix 2007-10-14 16:46:44 -07:00
nubus
of
oprofile
parisc [NET]: Make the device list and device lookups per namespace. 2007-10-10 16:49:10 -07:00
parport
pci more trivial signedness fixes in drivers 2007-10-14 12:41:52 -07:00
pcmcia signedness: module_param_array nump argument 2007-10-14 12:41:52 -07:00
pnp
power Driver core: change add_uevent_var to use a struct 2007-10-12 14:51:01 -07:00
ps3
rapidio
rtc
s390 Merge master.kernel.org:/pub/scm/linux/kernel/git/gregkh/driver-2.6 2007-10-12 15:49:37 -07:00
sbus
scsi Merge branch 'upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev 2007-10-12 16:16:41 -07:00
serial mpc52xx-uart: fix compile warning (format type mismatch) 2007-10-14 08:57:30 -07:00
sh
sn
spi Driver core: change add_uevent_var to use a struct 2007-10-12 14:51:01 -07:00
ssb missing include in ssb 2007-10-14 08:53:33 -07:00
tc
telephony
uio
usb signedness: module_param_array nump argument 2007-10-14 12:41:52 -07:00
video Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6 2007-10-14 08:59:48 -07:00
w1 Driver core: change add_uevent_var to use a struct 2007-10-12 14:51:01 -07:00
xen
zorro
Kconfig [SSB]: add Sonics Silicon Backplane bus support 2007-10-10 16:51:36 -07:00
Makefile [SSB]: add Sonics Silicon Backplane bus support 2007-10-10 16:51:36 -07:00