| Date | Tue, 29 Jan 2008 10:07:37 -0600 | From | Robin Holt <> | Subject | Re: [patch 1/6] mmu_notifier: Core code |
| |
I am going to seperate my comments into individual replies to help reduce the chance they are lost.
> +void mmu_notifier_release(struct mm_struct *mm) ... > + hlist_for_each_entry_safe_rcu(mn, n, t, > + &mm->mmu_notifier.head, hlist) { > + if (mn->ops->release) > + mn->ops->release(mn, mm); > + hlist_del(&mn->hlist);
This is a use-after-free issue. The hlist_del_rcu needs to be done before the callout as the structure containing the mmu_notifier structure will need to be freed from within the ->release callout.
Thanks, Robin
|