| Message ID | 200902111329.02954.hannes.hering@linux.vnet.ibm.com |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
Hannes Hering wrote: > Remove adapter from adapter list before freeing data structure in error path. ... > --- linux-2.6.29-rc4/drivers/net/ehea/ehea_main.c 2009-02-11 13:13:47.812542928 +0100 > +++ patched_kernel/drivers/net/ehea/ehea_main.c 2009-02-11 13:14:04.197540184 +0100 > @@ -3448,6 +3448,7 @@ out_kill_eq: > ehea_destroy_eq(adapter->neq); > > out_free_ad: > + list_del(&adapter->list); > kfree(adapter); > > out: On a related note, ehea_set_mac_addr()/ehea_update_bcmc_registrations() accesses adapter_list without serialization by ehea_fw_handles.lock and thus apparently unsafely. There may be other unsafe accesses of adapter_list; that's just the first one which I spotted.
From: Hannes Hering <hannes.hering@linux.vnet.ibm.com> Date: Wed, 11 Feb 2009 13:29:02 +0100 > Remove adapter from adapter list before freeing data structure in error path. > > Signed-off-by: Hannes Hering <hering2@de.ibm.com> Applied to net-next-2.6, thanks! -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff -Nurp -X dontdiff linux-2.6.29-rc4/drivers/net/ehea/ehea.h patched_kernel/drivers/net/ehea/ehea.h --- linux-2.6.29-rc4/drivers/net/ehea/ehea.h 2009-02-11 13:13:42.036506588 +0100 +++ patched_kernel/drivers/net/ehea/ehea.h 2009-02-11 13:14:04.197540184 +0100 @@ -40,7 +40,7 @@ #include <asm/io.h> #define DRV_NAME "ehea" -#define DRV_VERSION "EHEA_0097" +#define DRV_VERSION "EHEA_0098" /* eHEA capability flags */ #define DLPAR_PORT_ADD_REM 1 diff -Nurp -X dontdiff linux-2.6.29-rc4/drivers/net/ehea/ehea_main.c patched_kernel/drivers/net/ehea/ehea_main.c --- linux-2.6.29-rc4/drivers/net/ehea/ehea_main.c 2009-02-11 13:13:47.812542928 +0100 +++ patched_kernel/drivers/net/ehea/ehea_main.c 2009-02-11 13:14:04.197540184 +0100 @@ -3448,6 +3448,7 @@ out_kill_eq: ehea_destroy_eq(adapter->neq); out_free_ad: + list_del(&adapter->list); kfree(adapter); out:
Remove adapter from adapter list before freeing data structure in error path. Signed-off-by: Hannes Hering <hering2@de.ibm.com> --- -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html