Fix a use after free bug in kernel->userspace relay file support
Fix a use after free bug in kernel->userspace relay file support

Coverity spotted what looks like a real possible case of using a variable
after it has been freed.  The problem is in
kernel/relay.c::relay_open_buf()

If the code hits "goto free_buf;" it ends up in this code :

  free_buf:
    	relay_destroy_buf(buf);	<--- calls kfree() on 'buf'.
  free_name:
   	kfree(tmpname);
  end:
  	return buf;		<-- use after free of 'buf'.

I read through the callers and they all handle a NULL return from this
function as an error (and hitting the 'free_buf' label only happens on
failure to chan->cb->create_buf_file(), so that looks like a clear error to
me).

The patch simply sets 'buf' to NULL after the call to
relay_destroy_buf(buf); - as far as I can see that should take care of the
problem.

The patch also corrects a reference to a documentation file while
I was at it.

Note from Mathieu: the documentation reference change should have been
done in a separate patch, but I guess no one will really care.

Signed-off-by: Jesper Juhl <bfb89c44cbbbe2455148bba4fe1fe53868eb5ef5@gmail.com>
Acked-by: "David J. Wilder" <c99dc2f4f8d2e2b13883c936de59f520004971aa@us.ibm.com>
Tested-by: "David J. Wilder" <c99dc2f4f8d2e2b13883c936de59f520004971aa@us.ibm.com>
Signed-off-by: Mathieu Desnoyers <007bef6a47fb57dff675bfa1b0b798b4bdfbfc25@polymtl.ca>
Cc: Tom Zanussi <297b946f873924cd5a1d504d40f97384218921ea@us.ibm.com>
Cc: Karim Yaghmour <0df4ab017385e9aa3324400d725f59ea31c57132@opersys.com>
Signed-off-by: Andrew Morton <5c1e68b099950c134891f0b6e179498a8ebe9cf9@linux-foundation.org>
Signed-off-by: Linus Torvalds <69652caca27c8b940640ad396ab71f93cacec34f@linux-foundation.org>

KristFoundation/Programs,KristFoundation/Programs,TeamVee-Kanas/android_kernel_samsung_kanas,KristFoundation/Programs,TeamVee-Kanas/android_kernel_samsung_kanas,TeamVee-Kanas/android_kernel_samsung_kanas,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,TeamVee-Kanas/android_kernel_samsung_kanas,TeamVee-Kanas/android_kernel_samsung_kanas