Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1238772 > unrolled thread
| Started by | Sudip Mukherjee <sudipm.mukherjee@gmail.com> |
|---|---|
| First post | 2015-10-03 10:20 +0200 |
| Last post | 2015-10-05 04:40 +0200 |
| Articles | 2 — 2 participants |
Back to article view | Back to linux.kernel
[PATCH 1/2] NTB: fix access of free-ed pointer Sudip Mukherjee <sudipm.mukherjee@gmail.com> - 2015-10-03 10:20 +0200
Re: [PATCH 1/2] NTB: fix access of free-ed pointer Jon Mason <jdmason@kudzu.us> - 2015-10-05 04:40 +0200
| From | Sudip Mukherjee <sudipm.mukherjee@gmail.com> |
|---|---|
| Date | 2015-10-03 10:20 +0200 |
| Subject | [PATCH 1/2] NTB: fix access of free-ed pointer |
| Message-ID | <qfqcW-4Ce-13@gated-at.bofh.it> |
We were accessing nt->mw_vec after freeing it. Fix the error path so
that we free nt->mw_vec after we have finished using it.
Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org>
---
drivers/ntb/ntb_transport.c | 15 +++++++--------
1 file changed, 7 insertions(+), 8 deletions(-)
diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
index 6e3ee90..69953ee 100644
--- a/drivers/ntb/ntb_transport.c
+++ b/drivers/ntb/ntb_transport.c
@@ -1080,7 +1080,7 @@ static int ntb_transport_probe(struct ntb_client *self, struct ntb_dev *ndev)
GFP_KERNEL, node);
if (!nt->qp_vec) {
rc = -ENOMEM;
- goto err2;
+ goto err1;
}
if (nt_debugfs_dir) {
@@ -1092,7 +1092,7 @@ static int ntb_transport_probe(struct ntb_client *self, struct ntb_dev *ndev)
for (i = 0; i < qp_count; i++) {
rc = ntb_transport_init_queue(nt, i);
if (rc)
- goto err3;
+ goto err2;
}
INIT_DELAYED_WORK(&nt->link_work, ntb_transport_link_work);
@@ -1100,12 +1100,12 @@ static int ntb_transport_probe(struct ntb_client *self, struct ntb_dev *ndev)
rc = ntb_set_ctx(ndev, nt, &ntb_transport_ops);
if (rc)
- goto err3;
+ goto err2;
INIT_LIST_HEAD(&nt->client_devs);
rc = ntb_bus_init(nt);
if (rc)
- goto err4;
+ goto err3;
nt->link_is_up = false;
ntb_link_enable(ndev, NTB_SPEED_AUTO, NTB_WIDTH_AUTO);
@@ -1113,17 +1113,16 @@ static int ntb_transport_probe(struct ntb_client *self, struct ntb_dev *ndev)
return 0;
-err4:
- ntb_clear_ctx(ndev);
err3:
- kfree(nt->qp_vec);
+ ntb_clear_ctx(ndev);
err2:
- kfree(nt->mw_vec);
+ kfree(nt->qp_vec);
err1:
while (i--) {
mw = &nt->mw_vec[i];
iounmap(mw->vbase);
}
+ kfree(nt->mw_vec);
err:
kfree(nt);
return rc;
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [next] | [standalone]
| From | Jon Mason <jdmason@kudzu.us> |
|---|---|
| Date | 2015-10-05 04:40 +0200 |
| Message-ID | <qg3QZ-2nk-5@gated-at.bofh.it> |
| In reply to | #1238772 |
On Sat, Oct 3, 2015 at 4:09 AM, Sudip Mukherjee
<sudipm.mukherjee@gmail.com> wrote:
> We were accessing nt->mw_vec after freeing it. Fix the error path so
> that we free nt->mw_vec after we have finished using it.
>
> Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org>
Good catch. Pulled into my ntb branch.
Thanks,
Jon
> ---
> drivers/ntb/ntb_transport.c | 15 +++++++--------
> 1 file changed, 7 insertions(+), 8 deletions(-)
>
> diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
> index 6e3ee90..69953ee 100644
> --- a/drivers/ntb/ntb_transport.c
> +++ b/drivers/ntb/ntb_transport.c
> @@ -1080,7 +1080,7 @@ static int ntb_transport_probe(struct ntb_client *self, struct ntb_dev *ndev)
> GFP_KERNEL, node);
> if (!nt->qp_vec) {
> rc = -ENOMEM;
> - goto err2;
> + goto err1;
> }
>
> if (nt_debugfs_dir) {
> @@ -1092,7 +1092,7 @@ static int ntb_transport_probe(struct ntb_client *self, struct ntb_dev *ndev)
> for (i = 0; i < qp_count; i++) {
> rc = ntb_transport_init_queue(nt, i);
> if (rc)
> - goto err3;
> + goto err2;
> }
>
> INIT_DELAYED_WORK(&nt->link_work, ntb_transport_link_work);
> @@ -1100,12 +1100,12 @@ static int ntb_transport_probe(struct ntb_client *self, struct ntb_dev *ndev)
>
> rc = ntb_set_ctx(ndev, nt, &ntb_transport_ops);
> if (rc)
> - goto err3;
> + goto err2;
>
> INIT_LIST_HEAD(&nt->client_devs);
> rc = ntb_bus_init(nt);
> if (rc)
> - goto err4;
> + goto err3;
>
> nt->link_is_up = false;
> ntb_link_enable(ndev, NTB_SPEED_AUTO, NTB_WIDTH_AUTO);
> @@ -1113,17 +1113,16 @@ static int ntb_transport_probe(struct ntb_client *self, struct ntb_dev *ndev)
>
> return 0;
>
> -err4:
> - ntb_clear_ctx(ndev);
> err3:
> - kfree(nt->qp_vec);
> + ntb_clear_ctx(ndev);
> err2:
> - kfree(nt->mw_vec);
> + kfree(nt->qp_vec);
> err1:
> while (i--) {
> mw = &nt->mw_vec[i];
> iounmap(mw->vbase);
> }
> + kfree(nt->mw_vec);
> err:
> kfree(nt);
> return rc;
> --
> 1.9.1
>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web