lguest: dereferencing freed mem in add_eventfd()
"new" was freed and then dereferenced. Also the return value wasn't being
used so I modified the caller as well.
Compile tested only. Found by smatch (http://repo.or.cz/w/smatch.git).
regards,
dan carpenter
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
diff --git a/drivers/lguest/lguest_user.c b/drivers/lguest/lguest_user.c
index 9f9a295..407722a 100644
--- a/drivers/lguest/lguest_user.c
+++ b/drivers/lguest/lguest_user.c
@@ -52,8 +52,9 @@
new->map[new->num].addr = addr;
new->map[new->num].event = eventfd_ctx_fdget(fd);
if (IS_ERR(new->map[new->num].event)) {
+ int err = PTR_ERR(new->map[new->num].event);
kfree(new);
- return PTR_ERR(new->map[new->num].event);
+ return err;
}
new->num++;
@@ -83,7 +84,7 @@
err = add_eventfd(lg, addr, fd);
mutex_unlock(&lguest_lock);
- return 0;
+ return err;
}
/*L:050 Sending an interrupt is done by writing LHREQ_IRQ and an interrupt