Re: [PATCH V2] i40iw: Do not set self-referencing pointer to NULL after kfree

Leon Romanovsky
2016-08-23T01:41:35Z

[-- Attachment #1: Type: text/plain, Size: 1647 bytes --]

On Mon, Aug 22, 2016 at 07:01:47PM -0500, Shiraz Saleem wrote:
> From: Mustafa Ismail <mustafa.ismail-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>
>
> In i40iw_free_virt_mem(), do not set mem->va to NULL
> after freeing it as mem->va is a self-referencing pointer
> to mem.

Sorry, I failed to understand your commit message and your change.
What did you mean? How do you suppose to use mem->va pointer
after kfree() call on that pointer? Won't you have use-after-free bug in
such case?

>
> Fixes: 4e9042e647ff ("i40iw: add hw and utils files")
>
> Reported-by: Stefan Assmann <sassmann-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
> Signed-off-by: Mustafa Ismail <mustafa.ismail-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>
> Signed-off-by: Shiraz Saleem <shiraz.saleem-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>
> ---
>
> V2: Fix typo in subject line.
>
> drivers/infiniband/hw/i40iw/i40iw_utils.c | 1 -
> 1 file changed, 1 deletion(-)
>
> diff --git a/drivers/infiniband/hw/i40iw/i40iw_utils.c b/drivers/infiniband/hw/i40iw/i40iw_utils.c
> index 0e8db0a..d5f5de2 100644
> --- a/drivers/infiniband/hw/i40iw/i40iw_utils.c
> +++ b/drivers/infiniband/hw/i40iw/i40iw_utils.c
> @@ -674,7 +674,6 @@ enum i40iw_status_code i40iw_free_virt_mem(struct i40iw_hw *hw,
> if (!mem)
> return I40IW_ERR_PARAM;
> kfree(mem->va);
> - mem->va = NULL;
> return 0;
> }
>
> --
> 2.8.0
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
> the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]