Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932089AbWCFNsJ (ORCPT ); Mon, 6 Mar 2006 08:48:09 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S932297AbWCFNsJ (ORCPT ); Mon, 6 Mar 2006 08:48:09 -0500 Received: from cantor2.suse.de ([195.135.220.15]:908 "EHLO mx2.suse.de") by vger.kernel.org with ESMTP id S932089AbWCFNsI (ORCPT ); Mon, 6 Mar 2006 08:48:08 -0500 Date: Mon, 06 Mar 2006 14:48:02 +0100 Message-ID: From: Takashi Iwai To: Dave Jones Cc: Linux Kernel Subject: Re: opl3_oss use after free. In-Reply-To: <20060306091032.GA21851@redhat.com> References: <20060306090533.GA12999@redhat.com> <20060306091032.GA21851@redhat.com> User-Agent: Wanderlust/2.12.0 (Your Wildest Dreams) SEMI/1.14.6 (Maruoka) FLIM/1.14.7 (=?ISO-8859-4?Q?Sanj=F2?=) APEL/10.6 MULE XEmacs/21.5 (beta21) (corn) (+CVS-20050720) (i386-suse-linux) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 3524 Lines: 127 At Mon, 6 Mar 2006 04:10:32 -0500, Dave Jones wrote: > > On Mon, Mar 06, 2006 at 04:05:33AM -0500, Dave Jones wrote: > > Don't read from free'd memory. Also make use of the return > > value, and don't register the device if something went wrong > > creating the port. > > > > Coverity #955 > > identical bug in opl3_seq.c > This needs to check the return too, but I got lazy and just > fixed the use-after-free. > > Coverity #954 > > Signed-off-by: Dave Jones > > --- linux-2.6/sound/drivers/opl3/opl3_seq.c~ 2006-03-06 04:07:42.000000000 -0500 > +++ linux-2.6/sound/drivers/opl3/opl3_seq.c 2006-03-06 04:08:36.000000000 -0500 > @@ -207,8 +207,10 @@ static int snd_opl3_synth_create_port(st > 16, voices, > name); > if (opl3->chset->port < 0) { > + int port; > + port = opl3->chset->port; > snd_midi_channel_free_set(opl3->chset); > - return opl3->chset->port; > + return port; > } > return 0; > } > I gathered both and added the proper check of return value. Please check the below one. Thanks. --- [PATCH] Fix use after free in opl3_seq and opl3_oss Don't read from free'd memory. Also make use of the return value, and don't register the device if something went wrong creating the port. Coverity #954, #955 Signed-off-by: Dave Jones Signed-off-by: Takashi Iwai --- diff --git a/sound/drivers/opl3/opl3_oss.c b/sound/drivers/opl3/opl3_oss.c index 0345ae6..fccf019 100644 --- a/sound/drivers/opl3/opl3_oss.c +++ b/sound/drivers/opl3/opl3_oss.c @@ -104,8 +104,10 @@ static int snd_opl3_oss_create_port(stru voices, voices, name); if (opl3->oss_chset->port < 0) { + int port; + port = opl3->oss_chset->port; snd_midi_channel_free_set(opl3->oss_chset); - return opl3->oss_chset->port; + return port; } return 0; } @@ -136,10 +138,10 @@ void snd_opl3_init_seq_oss(struct snd_op arg->oper = oss_callback; arg->private_data = opl3; - snd_opl3_oss_create_port(opl3); - - /* register to OSS synth table */ - snd_device_register(opl3->card, dev); + if (snd_opl3_oss_create_port(opl3)) { + /* register to OSS synth table */ + snd_device_register(opl3->card, dev); + } } /* unregister */ diff --git a/sound/drivers/opl3/opl3_seq.c b/sound/drivers/opl3/opl3_seq.c index c4ead79..56b1d1a 100644 --- a/sound/drivers/opl3/opl3_seq.c +++ b/sound/drivers/opl3/opl3_seq.c @@ -207,8 +207,10 @@ static int snd_opl3_synth_create_port(st 16, voices, name); if (opl3->chset->port < 0) { + int port; + port = opl3->chset->port; snd_midi_channel_free_set(opl3->chset); - return opl3->chset->port; + return port; } return 0; } @@ -218,7 +220,7 @@ static int snd_opl3_synth_create_port(st static int snd_opl3_seq_new_device(struct snd_seq_device *dev) { struct snd_opl3 *opl3; - int client; + int client, err; char name[32]; int opl_ver; @@ -239,7 +241,11 @@ static int snd_opl3_seq_new_device(struc if (client < 0) return client; - snd_opl3_synth_create_port(opl3); + if ((err = snd_opl3_synth_create_port(opl3)) < 0) { + snd_seq_delete_kernel_client(client); + opl3->seq_client = -1; + return err; + } /* initialize instrument list */ opl3->ilist = snd_seq_instr_list_new(); - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/