Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1329581
| From | Andrew Morton <akpm@linux-foundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | Re: [PATCH 22/30] rapidio: add global inbound port write interfaces |
| Date | 2016-02-08 22:20 +0100 |
| Message-ID | <r01nY-2ow-23@gated-at.bofh.it> (permalink) |
| References | <qYXZ7-6YG-3@gated-at.bofh.it> <qYXZ8-6YG-23@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On Fri, 5 Feb 2016 18:19:38 -0500 Alexandre Bounine <alexandre.bounine@idt.com> wrote:
> +int rio_del_mport_pw_handler(struct rio_mport *mport, void *context,
> + int (*pwcback)(struct rio_mport *mport,
> + void *context, union rio_pw_msg *msg, int step))
> +{
> + int rc = -EINVAL;
> + struct rio_pwrite *pwrite;
> +
> + mutex_lock(&mport->lock);
> + list_for_each_entry(pwrite, &mport->pwrites, node) {
You have a use-after-free here - list_for_each_entry() references the
pwrite_node_next which was freed on the previous loop.
I'll switch this to list_for_each_entry_safe. Please test that change
and review the other patches for reoccurrences.
> + if (pwrite->pwcback == pwcback && pwrite->context == context) {
> + list_del(&pwrite->node);
> + kfree(pwrite);
> + rc = 0;
> + break;
> + }
> + }
> + mutex_unlock(&mport->lock);
> +
> + return rc;
> +}
> +EXPORT_SYMBOL_GPL(rio_del_mport_pw_handler);
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 22/30] rapidio: add global inbound port write interfaces Alexandre Bounine <alexandre.bounine@idt.com> - 2016-02-06 00:30 +0100
Re: [PATCH 22/30] rapidio: add global inbound port write interfaces Andrew Morton <akpm@linux-foundation.org> - 2016-02-08 22:20 +0100
RE: [PATCH 22/30] rapidio: add global inbound port write interfaces "Bounine, Alexandre" <Alexandre.Bounine@idt.com> - 2016-02-09 15:00 +0100
csiph-web