[lkml]   [2008]   [Jan]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [patch 1/6] mmu_notifier: Core code
    I am going to seperate my comments into individual replies to help
    reduce the chance they are lost.

    > +void mmu_notifier_release(struct mm_struct *mm)
    > + hlist_for_each_entry_safe_rcu(mn, n, t,
    > + &mm->mmu_notifier.head, hlist) {
    > + if (mn->ops->release)
    > + mn->ops->release(mn, mm);
    > + hlist_del(&mn->hlist);

    This is a use-after-free issue. The hlist_del_rcu needs to be done before
    the callout as the structure containing the mmu_notifier structure will
    need to be freed from within the ->release callout.


     \ /
      Last update: 2008-01-29 17:11    [W:0.019 / U:4.692 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site