From: James Bottomley <James.Bottomley@suse.de>
To: Andrew Morton <akpm@linux-foundation.org>
Cc: Dan Carpenter <error27@gmail.com>,
Adaptec OEM Raid Solutions <aacraid@adaptec.com>,
Yang Hongyang <yanghy@cn.fujitsu.com>,
OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>,
Alan Cox <alan@linux.intel.com>,
linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org,
kernel-janitors@vger.kernel.org
Subject: Re: [patch] dpt_i20: several use after free issues
Date: Mon, 15 Mar 2010 22:48:11 +0000 [thread overview]
Message-ID: <1268693291.2853.60.camel@mulgrave.site> (raw)
In-Reply-To: <20100315134526.0b2e3637.akpm@linux-foundation.org>
On Mon, 2010-03-15 at 13:45 -0700, Andrew Morton wrote:
> On Mon, 15 Mar 2010 11:26:56 +0300
> Dan Carpenter <error27@gmail.com> wrote:
>
> > adpt_i2o_delete_hba() calls kfree() so we have to save "pHba->next"
> > before calling it. Also inside adpt_i2o_delete_hba() itself, there
> > was another use after free bug which I fixed by moving the kfree()
> > down a line.
>
> erk. This code should be crashing most gruesomely. I wonder why it
> doesn't.
I'm tempted to say because we have no users, but actually, for this
driver, I know we do. So I think it works because most people don't
have poisoning turned on in a running system and there's no sleep
between the free and the use, so no opportunity to reuse the area on the
percpu hot list even in an smp system.
I'll add it to -rc fixes ... when I get the current misc tree broken
apart.
James
prev parent reply other threads:[~2010-03-15 22:48 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-03-15 8:26 [patch] dpt_i20: several use after free issues Dan Carpenter
2010-03-15 20:45 ` Andrew Morton
2010-03-15 22:48 ` James Bottomley [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1268693291.2853.60.camel@mulgrave.site \
--to=james.bottomley@suse.de \
--cc=aacraid@adaptec.com \
--cc=akpm@linux-foundation.org \
--cc=alan@linux.intel.com \
--cc=error27@gmail.com \
--cc=hirofumi@mail.parknet.co.jp \
--cc=kernel-janitors@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
--cc=yanghy@cn.fujitsu.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox