Messages in this thread Patch in this message | | | Date | Mon, 11 Dec 2006 23:34:34 -0600 | From | Robert Hancock <> | Subject | [PATCH -mm] sata_nv: fix kfree ordering in remove |
| |
Jeff Garzik wrote: > It is unwise to free the struct before the ports are even detached.
Right, theoretically something bad could happen here (though not likely). Here's a fix. Sorry for attaching with something so trivial, but Thunderbird isn't very cooperative..
---
The suspend/resume change for sata_nv introduced a potential bug where the hpriv structure could be used after it was freed in nv_remove_one. Fix that.
Signed-off-by: Robert Hancock <hancockr@shaw.ca>
--- Robert Hancock Saskatoon, SK, Canada To email, remove "nospam" from hancockr@nospamshaw.ca Home Page: http://www.roberthancock.com/ --- linux-2.6.19-rc6-mm2/drivers/ata/sata_nv.c 2006-12-11 22:13:26.000000000 -0600 +++ linux-2.6.19-rc6-mm2admafix/drivers/ata/sata_nv.c 2006-12-11 22:15:58.000000000 -0600 @@ -1555,8 +1555,8 @@ static void nv_remove_one (struct pci_de struct ata_host *host = dev_get_drvdata(&pdev->dev); struct nv_host_priv *hpriv = host->private_data; - kfree(hpriv); ata_pci_remove_one(pdev); + kfree(hpriv); } static int nv_pci_device_resume(struct pci_dev *pdev) | |