Messages in this thread | | | Date | Mon, 7 Sep 2015 15:11:30 +0100 | From | Luis Henriques <> | Subject | Re: [PATCH] zram: fix possible use after free in zcomp_create() |
| |
On Mon, Sep 07, 2015 at 10:33:32PM +0900, Sergey Senozhatsky wrote: > On (09/07/15 13:53), Luis Henriques wrote: > > > On (09/07/15 11:33), Luis Henriques wrote: > > > > zcomp_create() verifies the success of zcomp_strm_{multi,siggle}_create() > > > > through comp->stream, which can potentially be pointing to memory that was > > > > freed if these functions returned an error. > > > > > > > > > > good catch. > > > > > > we probably better start checking the zcomp_strm_multi_create()/ > > > zcomp_strm_single_create() status in zcomp_create(); that's much > > > more obvious and that's why we return it in the first place. > > > > > > what do you think? > > > > > > > Yep, that's probably a better solution. > > > > Acked-by: Luis Henriques <luis.henriques@canonical.com> > > > > Oh, thanks. I don't mind if you will re-submit it; I just did minor > changes to our fix. Or I can handle it. I'm OK with either way.
Ok, I'll be sending v2 in a minute.
>Btw, did you hit that problem or you reviewed the code? >
I've found this while looking at the code (I wouldn't really call it a "code review"... :-))
Cheers, -- Luís
| |