| Message ID | alpine.LNX.2.00.1104212303220.4159@swampdragon.chaosbits.net (mailing list archive) |
|---|---|
| State | Accepted |
| Headers | show |
diff --git a/drivers/media/dvb/siano/smsusb.c b/drivers/media/dvb/siano/smsusb.c index 0b8da57..0c8164a 100644 --- a/drivers/media/dvb/siano/smsusb.c +++ b/drivers/media/dvb/siano/smsusb.c @@ -297,9 +297,8 @@ static void smsusb_term_device(struct usb_interface *intf) if (dev->coredev) smscore_unregister_device(dev->coredev); - kfree(dev); - sms_info("device %p destroyed", dev); + kfree(dev); } usb_set_intfdata(intf, NULL);
In drivers/media/dvb/siano/smsusb.c we have this code: ... kfree(dev); sms_info("device %p destroyed", dev); ... at least one static analysis tool (Coverity Prevent) complains about this as a use-after-free bug. While it's true that we do use the pointer variable after freeing it, the only use is to print the value of the pointer, so there's not actually any problem here. But still, silencing the complaint is trivial by just moving the kfree() call below the sms_info(), so why not just do it?. It doesn't change the workings of the code in any way, but it makes the tool shut up. The patch below also removes a rather pointless blank line. Signed-off-by: Jesper Juhl <jj@chaosbits.net> --- smsusb.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)