Messages in this thread | | | Subject | Re: [PATCH] PCI: s390: Fix use-after-free of PCI bus resources with s390 per-function hotplug | From | Gerd Bayer <> | Date | Tue, 14 Feb 2023 10:46:45 +0100 |
| |
Hi Niklas,
when comparing pci_bus_remove_resource with pci_bus_remove_resources, I find that the "single-resource" variant might be ending too early.
On Fri, 2023-02-03 at 12:48 +0100, Niklas Schnelle wrote: > +void pci_bus_remove_resource(struct pci_bus *bus, struct resource > *res) > +{ > + struct pci_bus_resource *bus_res, *tmp; > + int i; > + > + for (i = 0; i < PCI_BRIDGE_RESOURCE_NUM; i++) { > + if (bus->resource[i] == res) { > + bus->resource[i] = NULL; > + return; ^^^^^^^ Did you mean to "break" here, rather than end the routine? > + } > + } > + > + list_for_each_entry_safe(bus_res, tmp, &bus->resources, list) > { > + if (bus_res->res == res) { > + list_del(&bus_res->list); > + kfree(bus_res); > + return; ^^^^^^^ Here "break" and "return" have the same effect, but "break" would be "symmetric". > + } > + } > + return; > + > +}
While this might be a nit, I'd like to better separate the "single- resource" variant's name. How about pci_bus_remove_one_resource - I know it's getting long...
Thanks, Gerd
| |