Alexander,
On Mon, Apr 12, 2010 at 07:51:12PM +0400, Alexander Kurz wrote:
> @@ -691,7 +701,8 @@ static void pcmciamtd_detach(struct pcmcia_device *link)
> if(dev->mtd_info) {
> del_mtd_device(dev->mtd_info);
> map_destroy(dev->mtd_info);
> - info("mtd%d: Removed", dev->mtd_info->index);
> + dev_info(&dev->p_dev->dev, "mtd%d: Removed\n",
> + dev->mtd_info->index);
> }
Could you switch the ordering between map_destroy() and dev_info(), please,
to avoid an use-after-free? See the attached message by Julia Lawall, who
noted this issue first.
Best,
Dominik
--- Begin Message ---
From: Julia Lawall <[email protected]>
Moved the debugging message before the call to map_destroy, which frees its
argument. The message is also slightly changed to reflect its new
position.
A simplified version of the semantic patch that finds this problem is as
follows: (http://coccinelle.lip6.fr/)
// <smpl>
@@
expression E,E2;
@@
del_mtd_device(E)
...
(
E = E2
|
* E
)
// </smpl>
Signed-off-by: Julia Lawall <[email protected]>
---
drivers/mtd/maps/pcmciamtd.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/drivers/mtd/maps/pcmciamtd.c b/drivers/mtd/maps/pcmciamtd.c
index 87b2b8f..3e339de 100644
--- a/drivers/mtd/maps/pcmciamtd.c
+++ b/drivers/mtd/maps/pcmciamtd.c
@@ -689,8 +689,8 @@ static void pcmciamtd_detach(struct pcmcia_device *link)
if(dev->mtd_info) {
del_mtd_device(dev->mtd_info);
+ info("mtd%d: Removing", dev->mtd_info->index);
map_destroy(dev->mtd_info);
- info("mtd%d: Removed", dev->mtd_info->index);
}
pcmciamtd_release(link);
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
--- End Message ---
_______________________________________________
Linux PCMCIA reimplementation list
http://lists.infradead.org/mailman/listinfo/linux-pcmcia
