2009-11-18 08:30:17

by Dan Carpenter

Subject: [patch] rtc: use after free in pcf50633_rtc_probe()

"rtc" is freed and then dereferenced on the next line. This patch fixes
that.

This is a resend. I have been offline for the last few months so I may
have missed a reply or something. Not sure what the status was.

regards,
dan carpenter

Signed-off-by: Dan Carpenter <[email protected]>

--- orig/drivers/rtc/rtc-pcf50633.c 2009-07-17 16:21:52.000000000 +0300
+++ new/drivers/rtc/rtc-pcf50633.c 2009-07-17 16:22:56.000000000 +0300
@@ -291,8 +291,9 @@
&pcf50633_rtc_ops, THIS_MODULE);

if (IS_ERR(rtc->rtc_dev)) {
+ int ret = PTR_ERR(rtc->rtc_dev);
kfree(rtc);
- return PTR_ERR(rtc->rtc_dev);
+ return ret;
}

pcf50633_register_irq(rtc->pcf, PCF50633_IRQ_ALARM,

2009-11-18 10:13:07

by Alessandro Zummo

Subject: Re: [rtc-linux] [patch] rtc: use after free in pcf50633_rtc_probe()

On Wed, 18 Nov 2009 10:30:14 +0200 (SAST)
Dan Carpenter <[email protected]> wrote:

> "rtc" is freed and then dereferenced on the next line. This patch fixes
> that.
>
> This is a resend. I have been offline for the last few months so I may
> have missed a reply or something. Not sure what the status was.
>
> regards,
> dan carpenter
>
> Signed-off-by: Dan Carpenter <[email protected]>


Acked-by: Alessandro Zummo <[email protected]>

--

Best regards,

Alessandro Zummo,
Tower Technologies - Torino, Italy

http://www.towertech.it