[lkml]   [2011]   [Jun]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [PATCH] mm: dmapool: fix possible use after free in dmam_pool_destroy()

    On Thu, Jun 02, 2011 at 05:22:42PM +0300, Maxin B John wrote:
    > > The pool itself is not used there, only the address where the pool
    > > has been.This will only lead to any trouble if something else is allocated to
    > > the same place and inserted into the devres list of the same device between
    > > the dma_pool_destroy() and devres_destroy().

    Which can't happen. devres release is bound to device driver model
    and a device can't be re-attached before release is complete.
    ie. those operations are serialized, so the failure mode is only

    > Thank you very much for explaining it in detail.
    > > But I agree that this is bad style. But if you are going to change
    > > this please also have a look at devm_iounmap() in lib/devres.c. Maybe also the
    > > devm_*irq* functions need the same changes.
    > As per your suggestion, I have made similar modifications for lib/devres.c and
    > kernel/irq/devres.c
    > CCed the maintainers of the respective files.
    > Signed-off-by: Maxin B. John <>

    But it shouldn't hurt and if it helps memleak.

    Acked-by: Tejun Heo <>



     \ /
      Last update: 2011-06-09 12:23    [W:0.045 / U:33.092 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site