From: Rolf Eike Beer <eike-kernel@sf-tec.de>
To: Maxin B John <maxin.john@gmail.com>
Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org,
akpm@linux-foundation.org, dima@android.com,
willy@linux.intel.com
Subject: Re: [PATCH] mm: dmapool: fix possible use after free in dmam_pool_destroy()
Date: Thu, 02 Jun 2011 11:47:36 +0200 [thread overview]
Message-ID: <3647102.7SB09c9jIV@donald.sf-tec.de> (raw)
In-Reply-To: <20110601214313.GA3724@maxin>
[-- Attachment #1: Type: text/plain, Size: 718 bytes --]
Maxin B John wrote:
> "dma_pool_destroy(pool)" calls "kfree(pool)". The freed pointer "pool"
> is again passed as an argument to the function "devres_destroy()".
> This patch fixes the possible use after free.
>
> Please let me know your comments.
The pool itself is not used there, only the address where the pool has been.
This will only lead to any trouble if something else is allocated to the same
place and inserted into the devres list of the same device between the
dma_pool_destroy() and devres_destroy().
But I agree that this is bad style. But if you are going to change this please
also have a look at devm_iounmap() in lib/devres.c. Maybe also the devm_*irq*
functions need the same changes.
Eike
[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 198 bytes --]
next prev parent reply other threads:[~2011-06-02 12:14 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-06-01 21:43 [PATCH] mm: dmapool: fix possible use after free in dmam_pool_destroy() Maxin B John
2011-06-02 9:47 ` Rolf Eike Beer [this message]
-- strict thread matches above, loose matches on Subject: below --
2011-06-02 14:22 Maxin B John
2011-06-06 8:37 ` Maxin B John
2011-06-07 18:05 ` Rolf Eike Beer
2011-06-08 10:46 ` Maxin B John
2011-06-08 13:13 ` Rolf Eike Beer
2011-06-09 10:20 ` Tejun Heo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3647102.7SB09c9jIV@donald.sf-tec.de \
--to=eike-kernel@sf-tec.de \
--cc=akpm@linux-foundation.org \
--cc=dima@android.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=maxin.john@gmail.com \
--cc=willy@linux.intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).