Messages in this thread Patch in this message | | | Date | Thu, 2 Jun 2011 00:43:13 +0300 | From | Maxin B John <> | Subject | [PATCH] mm: dmapool: fix possible use after free in dmam_pool_destroy() |
| |
"dma_pool_destroy(pool)" calls "kfree(pool)". The freed pointer "pool" is again passed as an argument to the function "devres_destroy()". This patch fixes the possible use after free.
Please let me know your comments.
Signed-off-by: Maxin B. John <maxin.john@gmail.com> --- diff --git a/mm/dmapool.c b/mm/dmapool.c index 03bf3bb..fbb58e3 100644 --- a/mm/dmapool.c +++ b/mm/dmapool.c @@ -500,7 +500,7 @@ void dmam_pool_destroy(struct dma_pool *pool) { struct device *dev = pool->dev; - dma_pool_destroy(pool); WARN_ON(devres_destroy(dev, dmam_pool_release, dmam_pool_match, pool)); + dma_pool_destroy(pool); } EXPORT_SYMBOL(dmam_pool_destroy);
| |