lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 22 Jan 2015 23:50:19 -0500 From: Sasha Levin <sasha.levin@...cle.com> To: minyard@....org, Nicholas Krause <xerofoify@...il.com> CC: openipmi-developer@...ts.sourceforge.net, linux-kernel@...r.kernel.org Subject: Re: [PATCH RESEND] char:ipmi: Free ipmi_recv_msg messages from the linked list,recv_msgs for the function,ipmi_release in the file,ipmi_devintf.c On 01/22/2015 08:05 AM, Corey Minyard wrote: > Patch is queued for 3.20. Thanks. That patch is horribly broken. Thanks, Sasha > -corey > > On 01/19/2015 09:14 PM, Nicholas Krause wrote: >> This adds a loop through the elements in the linked list, recv_msgs using >> list_for_entry_safe in order to free messages in this list. In addition >> we are using the safe version of this marco in order to prevent use after >> bugs related to deleting the element we are on currently by holding a >> pointer to the next element after the current one we are on and freeing >> with the function, ipmi_free_recv_msg internally in this loop. >> >> Signed-off-by: Nicholas Krause <xerofoify@...il.com> >> --- >> drivers/char/ipmi/ipmi_devintf.c | 7 ++++--- >> 1 file changed, 4 insertions(+), 3 deletions(-) >> >> diff --git a/drivers/char/ipmi/ipmi_devintf.c b/drivers/char/ipmi/ipmi_devintf.c >> index ec318bf..d2af38a 100644 >> --- a/drivers/char/ipmi/ipmi_devintf.c >> +++ b/drivers/char/ipmi/ipmi_devintf.c >> @@ -157,14 +157,15 @@ static int ipmi_release(struct inode *inode, struct file *file) >> { >> struct ipmi_file_private *priv = file->private_data; >> int rv; >> + struct ipmi_recv_msg *msg, *next; >> >> rv = ipmi_destroy_user(priv->user); >> if (rv) >> return rv; >> >> - /* FIXME - free the messages in the list. */ >> - kfree(priv); >> - >> + list_for_each_entry_safe(msg, next, &priv->recv_msgs, link) { >> + ipmi_free_recv_msg(msg); >> + } >> return 0; >> } >> > > -- > To unsubscribe from this list: send the line "unsubscribe linux-kernel" in > the body of a message to majordomo@...r.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html > Please read the FAQ at http://www.tux.org/lkml/ > -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists