Messages in this thread | | | From | Andy Shevchenko <> | Date | Tue, 12 Oct 2021 23:48:46 +0300 | Subject | Re: [PATCH] iio: buffer: Fix double-free in iio_buffers_alloc_sysfs_and_mask() |
| |
On Tue, Oct 12, 2021 at 8:43 PM Joe Perches <joe@perches.com> wrote: > > On Tue, 2021-10-12 at 23:30 +0300, Andy Shevchenko wrote: > > On Tue, Oct 12, 2021 at 2:37 PM Alexandru Ardelean > > <ardeleanalex@gmail.com> wrote: > > > > > > On Tue, Oct 12, 2021 at 12:18 PM Yang Yingliang > > > <yangyingliang@huawei.com> wrote: > > > > > > > > When __iio_buffer_alloc_sysfs_and_mask() failed, 'unwind_idx' should be > > > > set to 'i - 1' to prevent double-free when cleanup resources. > [] > > > > I prefer to see > > > > - for (; unwind_idx >= 0; unwind_idx--) { > > + while (unwind_idx--) > > Not the same code as unwind_idx would be decremented before entering > the code block.
It's kinda cryptic what you are pointing out.
What's needed additionally is to change
- unwind_idx = iio_dev_opaque->attached_buffers_cnt - 1; + unwind_idx = i;
> You'd want > > do { > ... > } while (unwind_idx--);
Of course not. See above. The usual pattern is
while (i--) do_clean_item(i);
-- With Best Regards, Andy Shevchenko
| |