netdev - smatch stuff: use after free bug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20110328103140.GJ1885@bicker>
Date:	Mon, 28 Mar 2011 13:31:40 +0300
From:	Dan Carpenter <error27@...il.com>
To:	Yevgeny Petrilin <yevgenyp@...lanox.co.il>
Cc:	netdev@...r.kernel.org
Subject: smatch stuff: use after free bug

Smatch complains about this.  It's not obvious to me how to fix it.  The
bug was introduced in b12d93d63 "mlx4: Add support for promiscuous mode
in the new steering model.".

drivers/net/mlx4/mcg.c +530
	remove_promisc_qp(89) warn: 'pqp' was already freed.

   526  out_mailbox:
   527          mlx4_free_cmd_mailbox(dev, mailbox);
   528  out_list:
   529          if (back_to_list)
   530                  list_add_tail(&pqp->list, &s_steer->promisc_qps[steer]);
                                      ^^^^^^^^^^

This list was deleted and pqp was freed at this point.

   531  out_mutex:
   532          mutex_unlock(&priv->mcg_table.mutex);
   533          return err;
   534  }

regards,
dan carpenter
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html