Messages in this thread | | | Date | Sat, 19 Oct 2013 08:49:10 -0300 | Subject | Re: net: sctp: possible dereference after freeing | From | Geyslan Gregório Bem <> |
| |
2013/10/19 Geyslan Gregório Bem <geyslan@gmail.com>: > Hi maintainers, > > I would like to know if these are catches: > > /net/sctp/endpointola.c (281) > static void sctp_endpoint_destroy(struct sctp_endpoint *ep) > { > struct sock *sk; > ... > kfree(ep); > SCTP_DBG_OBJCNT_DEC(ep); > } > > The 'ep' object counter is being decremented?! Is the kfree to be there indeed? > Let me know what was intended here. > > Same here: > /net/sctp/endpointola.c (165) > static void sctp_transport_destroy_rcu(struct rcu_head *head) > { > struct sctp_transport *transport; > ... > kfree(transport); > SCTP_DBG_OBJCNT_DEC(transport); > } > > Regards, > > Geyslan Gregório Bem > hackingbits.com
Oops. I got it. ;)
extern atomic_t sctp_dbg_objcnt_ep; http://lxr.free-electrons.com/source/include/net/sctp/sctp.h#L269 extern atomic_t sctp_dbg_objcnt_transport; http://lxr.free-electrons.com/source/arch/x86/include/asm/atomic.h#L105
Cheers. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |