Re: Oops on ibmasm

[Dave Jones <davej@redhat.com>]

On Thu, Mar 09, 2006 at 01:40:23AM -0800, Andrew Morton wrote:

 > I assume this'll fix it?
 > 
 > I suspect there's no point in the locking around that kobject_put() anyway.
 > Or if there is, it wasn't the right way to fix the race.
 > 
 > diff -puN drivers/misc/ibmasm/ibmasm.h~ibmasm-use-after-free-fix drivers/misc/ibmasm/ibmasm.h
 > --- devel/drivers/misc/ibmasm/ibmasm.h~ibmasm-use-after-free-fix	2006-03-09 01:35:05.000000000 -0800
 > +++ devel-akpm/drivers/misc/ibmasm/ibmasm.h	2006-03-09 01:35:16.000000000 -0800
 > @@ -100,11 +100,7 @@ struct command {
 >  
 >  static inline void command_put(struct command *cmd)
 >  {
 > -	unsigned long flags;
 > -
 > -	spin_lock_irqsave(cmd->lock, flags);
 >          kobject_put(&cmd->kobj);
 > -	spin_unlock_irqrestore(cmd->lock, flags);
 >  }

I don't think this is right.  This is just a kobject-convoluted
use-after-free afaics.

		Dave

-- 
http://www.codemonkey.org.uk