mm: dmapool: fix possible use after free in dmam_pool_destroy()

"dma_pool_destroy(pool)" calls "kfree(pool)". The freed pointer "pool" is again passed as an argument to the function "devres_destroy()". This patch fixes the possible use after free.

Please let me know your comments.

---

index 03bf3bb..fbb58e3 100644
@@ -500,7 +500,7 @@ void dmam_pool_destroy(struct dma_pool *pool)
 {
 	struct device *dev = pool->dev;
 
-	dma_pool_destroy(pool);
 	WARN_ON(devres_destroy(dev, dmam_pool_release, dmam_pool_match, pool));
+	dma_pool_destroy(pool);
 }
 EXPORT_SYMBOL(dmam_pool_destroy);

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to [email protected]. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Fight unfair telecom internet charges in Canada: sign http://stopthemeter.ca/
Don't email: <a href=mailto:"[email protected]"> [email protected] </a>

The pool itself is not used there, only the address where the pool has been. This will only lead to any trouble if something else is allocated to the same place and inserted into the devres list of the same device between the dma_pool_destroy() and devres_destroy().

But I agree that this is bad style. But if you are going to change this please also have a look at devm_iounmap() in lib/devres.c. Maybe also the devm_*irq* functions need the same changes.

Eike