diff mbox

xen-netback: double free on unload

Message ID 20130621062008.GA10873@elgon.mountain
State Accepted, archived
Delegated to: David Miller
Headers show

Commit Message

Dan Carpenter June 21, 2013, 6:20 a.m. UTC
There is a typo here, "i" vs "j", so we would crash on module_exit().

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

Wei Liu June 21, 2013, 9:51 a.m. UTC | #1
On Fri, Jun 21, 2013 at 09:20:08AM +0300, Dan Carpenter wrote:
> There is a typo here, "i" vs "j", so we would crash on module_exit().
> 
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> 
> diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
> index a0b50ad..130bcb2 100644
> --- a/drivers/net/xen-netback/netback.c
> +++ b/drivers/net/xen-netback/netback.c
> @@ -1968,8 +1968,8 @@ static void __exit netback_fini(void)
>  		del_timer_sync(&netbk->net_timer);
>  		kthread_stop(netbk->task);
>  		for (j = 0; j < MAX_PENDING_REQS; j++) {
> -			if (netbk->mmap_pages[i])
> -				__free_page(netbk->mmap_pages[i]);
> +			if (netbk->mmap_pages[j])
> +				__free_page(netbk->mmap_pages[j]);

Nice catch, thanks.


Wei.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
David Miller June 24, 2013, 7:26 a.m. UTC | #2
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Fri, 21 Jun 2013 09:20:08 +0300

> There is a typo here, "i" vs "j", so we would crash on module_exit().
> 
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Please always explicitly state the tree for which a patch is
applicable.

Here I figured it out by trial an error, trying to apply it
to 'net' (where it failed) and then 'net-next' (where it
applied cleanly).

I should never have to play patch monkey games like that, you
need to tell me where a patch is targetted.

Thanks.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Julia Lawall June 24, 2013, 7:31 a.m. UTC | #3
On Mon, 24 Jun 2013, David Miller wrote:

> From: Dan Carpenter <dan.carpenter@oracle.com>
> Date: Fri, 21 Jun 2013 09:20:08 +0300
>
> > There is a typo here, "i" vs "j", so we would crash on module_exit().
> >
> > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> Please always explicitly state the tree for which a patch is
> applicable.
>
> Here I figured it out by trial an error, trying to apply it
> to 'net' (where it failed) and then 'net-next' (where it
> applied cleanly).
>
> I should never have to play patch monkey games like that, you
> need to tell me where a patch is targetted.

Shouldn't one always, by default, work on linux-next?

julia
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
David Miller June 24, 2013, 8:44 a.m. UTC | #4
From: Julia Lawall <julia.lawall@lip6.fr>
Date: Mon, 24 Jun 2013 08:31:31 +0100 (BST)

> On Mon, 24 Jun 2013, David Miller wrote:
> 
>> From: Dan Carpenter <dan.carpenter@oracle.com>
>> Date: Fri, 21 Jun 2013 09:20:08 +0300
>>
>> > There is a typo here, "i" vs "j", so we would crash on module_exit().
>> >
>> > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>>
>> Please always explicitly state the tree for which a patch is
>> applicable.
>>
>> Here I figured it out by trial an error, trying to apply it
>> to 'net' (where it failed) and then 'net-next' (where it
>> applied cleanly).
>>
>> I should never have to play patch monkey games like that, you
>> need to tell me where a patch is targetted.
> 
> Shouldn't one always, by default, work on linux-next?

Bug fixes, especially serious ones, should be targetted at 'net'.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Dan Carpenter June 24, 2013, 8:57 a.m. UTC | #5
I'm sorry.  For some reason I got confused and thought this bug was
older.  I'll update my QC scripts to test for this.

regards,
dan carpenter

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index a0b50ad..130bcb2 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -1968,8 +1968,8 @@  static void __exit netback_fini(void)
 		del_timer_sync(&netbk->net_timer);
 		kthread_stop(netbk->task);
 		for (j = 0; j < MAX_PENDING_REQS; j++) {
-			if (netbk->mmap_pages[i])
-				__free_page(netbk->mmap_pages[i]);
+			if (netbk->mmap_pages[j])
+				__free_page(netbk->mmap_pages[j]);
 		}
 	}