lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 6 Jan 2014 11:09:58 +0000 From: Ian Campbell <Ian.Campbell@...rix.com> To: David Vrabel <david.vrabel@...rix.com> CC: Levente Kurusa <levex@...ux.com>, Stefano Stabellini <stefano.stabellini@...citrix.com>, Greg Kroah-Hartman <gregkh@...uxfoundation.org>, LKML <linux-kernel@...r.kernel.org>, <xen-devel@...ts.xenproject.org>, Andrew Morton <akpm@...ux-foundation.org>, Boris Ostrovsky <boris.ostrovsky@...cle.com> Subject: Re: [Xen-devel] [PATCH 26/38] xen: xenbus: add missing put_device call On Mon, 2014-01-06 at 11:00 +0000, David Vrabel wrote: > On 06/01/14 10:00, Ian Campbell wrote: > > On Thu, 2014-01-02 at 13:53 +0000, David Vrabel wrote: > >> On 19/12/13 15:03, Levente Kurusa wrote: > >>> This is required so that we give up the last reference to the device. > >>> > >>> Signed-off-by: Levente Kurusa <levex@...ux.com> > >>> --- > >>> drivers/xen/xenbus/xenbus_probe.c | 4 +++- > >>> 1 file changed, 3 insertions(+), 1 deletion(-) > >>> > >>> diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c > >>> index 3c0a74b..4abb9ee 100644 > >>> --- a/drivers/xen/xenbus/xenbus_probe.c > >>> +++ b/drivers/xen/xenbus/xenbus_probe.c > >>> @@ -465,8 +465,10 @@ int xenbus_probe_node(struct xen_bus_type *bus, > >>> > >>> /* Register with generic device framework. */ > >>> err = device_register(&xendev->dev); > >>> - if (err) > >>> + if (err) { > >>> + put_device(&xendev->dev); > >>> goto fail; > >>> + } > >>> > >>> return 0; > >>> fail: > >> > >> There is a kfree(xendev) here so this introduces a double-free. > > > > How? put_device doesn't touch xendev itself, does it? It just drops the > > ref on the dev member which is not separately dynamically allocated and > > so not freed either. > > Releasing all references to the struct device frees the containing > structure via xenbus->dev.release. i.e., xenbus_dev_release() which does > kfree(xendev). Ooh, twisty, well spotted ;-) Ian. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists