diff mbox

[U-Boot] ubifs: Fix bad free() sequence in ubifs_finddir()

Message ID 1311859642-5153-1-git-send-email-wd@denx.de
State Accepted
Commit 3267bc1b2b52a8ffd0dfda663c02c86eaab6f70d
Delegated to: Stefan Roese
Headers show

Commit Message

Wolfgang Denk July 28, 2011, 1:27 p.m. UTC 
Free private_data member element before freeing file structure.
This was causing malloc to crash. Also remove unnecessary variable
assigments as file structure gets free'd as well.

Signed-off-by: Rod Boyce <uboot@teamboyce.co.uk>
Signed-off-by: Wolfgang Denk <wd@denx.de>
Cc: Stefan Roese <sr@denx.de>
---
As Rod appears to have disappeared I took the frredom to jump in and
fix this. - wd

 fs/ubifs/ubifs.c |    6 ++----
 1 files changed, 2 insertions(+), 4 deletions(-)

Comments

Rod Boyce July 28, 2011, 2:09 p.m. UTC | #1 
On 28/07/11 14:27, Wolfgang Denk wrote:
> As Rod appears to have disappeared I took the frredom to jump in and
> fix this. - wd
>

All,

Sorry about this I missed the e-mail asking me to reformat the patch.  
Thanks for sorting this out Wolfgang.

Regards,
Rod Boyce
Stefan Roese Aug. 19, 2011, 3:22 p.m. UTC | #2 
On Thursday 28 July 2011 15:27:22 Wolfgang Denk wrote:
> Free private_data member element before freeing file structure.
> This was causing malloc to crash. Also remove unnecessary variable
> assigments as file structure gets free'd as well.

Applied to u-boot-ubi/master. Thanks.

Best regards,
Stefan

--
DENX Software Engineering GmbH,      MD: Wolfgang Denk & Detlev Zundel
HRB 165235 Munich,  Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-0 Fax: (+49)-8142-66989-80 Email: office@denx.de
diff mbox

Patch

diff --git a/fs/ubifs/ubifs.c b/fs/ubifs/ubifs.c
index 5a5c739..61f70b2 100644
--- a/fs/ubifs/ubifs.c
+++ b/fs/ubifs/ubifs.c
@@ -360,6 +360,8 @@  out:
 		return err;
 	}
 
+	if (file->private_data)
+		kfree(file->private_data);
 	if (file)
 		free(file);
 	if (dentry)
@@ -367,10 +369,6 @@  out:
 	if (dir)
 		free(dir);
 
-	if (file->private_data)
-		kfree(file->private_data);
-	file->private_data = NULL;
-	file->f_pos = 2;
 	return 0;
 }