Messages in this thread | | | Date | Tue, 7 Feb 2006 09:44:05 -0800 | From | Greg KH <> | Subject | Re: [PATCH] ibmasm driver: don't use previously freed pointer |
| |
On Tue, Feb 07, 2006 at 09:29:17AM -0800, Max Asbock wrote: > On Fri, 2006-02-03 at 22:02, Greg KH wrote: > > On Fri, Feb 03, 2006 at 02:26:38PM -0800, Max Asbock wrote: > > > ibmasm driver: > > > Fix the command_put() function which uses a pointer for a spinlock that > > > can be freed before dereferencing it. > > > > > > Signed-off-by: Max Asbock masbock@us.ibm.com > > > > > > --- > > > > > > diff -burpN linux-2.6.16-rc1/drivers/misc/ibmasm/ibmasm.h linux-2.6.16-rc1.ibmasm/drivers/misc/ibmasm/ibmasm.h > > > --- linux-2.6.16-rc1/drivers/misc/ibmasm/ibmasm.h 2006-02-01 11:50:01.000000000 -0800 > > > +++ linux-2.6.16-rc1.ibmasm/drivers/misc/ibmasm/ibmasm.h 2006-02-03 13:57:42.000000000 -0800 > > > @@ -101,10 +101,11 @@ struct command { > > > static inline void command_put(struct command *cmd) > > > { > > > unsigned long flags; > > > + spinlock_t *lock = cmd->lock; > > > > > > - spin_lock_irqsave(cmd->lock, flags); > > > + spin_lock_irqsave(lock, flags); > > > kobject_put(&cmd->kobj); > > > - spin_unlock_irqrestore(cmd->lock, flags); > > > + spin_unlock_irqrestore(lock, flags); > > > } > > > > If this patch is true, doesn't the spinlock the pointer is pointing out > > still get deleted? > > > > Yes you save a pointer off, but it looks like the problem is still > > present. > > > > Or am I missing something? > > > > The lock pointer in struct command points to a spinlock outside the > structure that doesn't get deleted.
Ok, that's what I was missing, nevermind then :)
thanks,
greg k-h - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |