Messages in this thread | | | Date | Mon, 19 Mar 2007 10:23:10 +0100 | From | Adrian Bunk <> | Subject | drivers/infiniband/ulp/ipoib/ipoib_main.c: use-after-free |
| |
The Coverity checker spotted the following code introduced by commit 839fcaba355abaffb7b44f0f4504093acb0b11cf:
<-- snip -->
... static void path_rec_completion(int status, struct ib_sa_path_rec *pathrec, void *path_ptr) { ... list_for_each_entry(neigh, &path->neigh_list, list) { kref_get(&path->ah->ref); neigh->ah = path->ah; memcpy(&neigh->dgid.raw, &path->pathrec.dgid.raw, sizeof(union ib_gid));
if (ipoib_cm_enabled(dev, neigh->neighbour)) { if (!ipoib_cm_get(neigh)) ipoib_cm_set(neigh, ipoib_cm_create_tx(dev, path, neigh)); if (!ipoib_cm_get(neigh)) { list_del(&neigh->list); if (neigh->ah) ipoib_put_ah(neigh->ah); ipoib_neigh_free(dev, neigh); continue; } }
while ((skb = __skb_dequeue(&neigh->queue))) __skb_queue_tail(&skqueue, skb); } ...
<-- snip -->
Notice that before the continue "neigh" gets freed, but the list_for_each_entry() for() loop uses it.
cu Adrian
--
"Is there not promise of rain?" Ling Tan asked suddenly out of the darkness. There had been need of rain for many days. "Only a promise," Lao Er said. Pearl S. Buck - Dragon Seed
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |