In drivers/media/dvb/siano/smsusb.c we have this code:
...
kfree(dev);
sms_info("device %p destroyed", dev);
...
at least one static analysis tool (Coverity Prevent) complains about this
as a use-after-free bug.
While it's true that we do use the pointer variable after freeing it, the
only use is to print the value of the pointer, so there's not actually any
problem here. But still, silencing the complaint is trivial by just moving
the kfree() call below the sms_info(), so why not just do it?. It doesn't
change the workings of the code in any way, but it makes the tool shut up.
The patch below also removes a rather pointless blank line.
Signed-off-by: Jesper Juhl <jj@xxxxxxxxxxxxx>
---
smsusb.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/media/dvb/siano/smsusb.c b/drivers/media/dvb/siano/smsusb.c
index 0b8da57..0c8164a 100644
--- a/drivers/media/dvb/siano/smsusb.c
+++ b/drivers/media/dvb/siano/smsusb.c
@@ -297,9 +297,8 @@ static void smsusb_term_device(struct usb_interface *intf)
if (dev->coredev)
smscore_unregister_device(dev->coredev);
- kfree(dev);
-
sms_info("device %p destroyed", dev);
+ kfree(dev);
}
usb_set_intfdata(intf, NULL);
--
Jesper Juhl <jj@xxxxxxxxxxxxx> http://www.chaosbits.net/
Don't top-post http://www.catb.org/jargon/html/T/top-post.html
Plain text mails only, please.
--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
