• Julia Lawall's avatar
    ext4: Eliminate potential double free on error path · d3533d72
    Julia Lawall authored
    b_entry_name and buffer are initially NULL, are initialized within a loop
    to the result of calling kmalloc, and are freed at the bottom of this loop.
    The loop contains gotos to cleanup, which also frees b_entry_name and
    buffer.  Some of these gotos are before the reinitializations of
    b_entry_name and buffer.  To maintain the invariant that b_entry_name and
    buffer are NULL at the top of the loop, and thus acceptable arguments to
    kfree, these variables are now set to NULL after the kfrees.
    
    This seems to be the simplest solution.  A more complicated solution
    would be to introduce more labels in the error handling code at the end of
    the function.
    
    A simplified version of the semantic match that finds this problem is as
    follows: (http://coccinelle.lip6.fr/)
    
    // <smpl>
    @r@
    identifier E;
    expression E1;
    iterator I;
    statement S;
    @@
    
    *kfree(E);
    ... when != E = E1
        when != I(E,...) S
        when != &E
    *kfree(E);
    // </smpl>
    Signed-off-by: default avatarJulia Lawall <julia@diku.dk>
    Signed-off-by: default avatar"Theodore Ts'o" <tytso@mit.edu>
    d3533d72
xattr.c 42.2 KB