Skip to contentSkip to conversation

xen-netback: double free on unload

PATCH In review Dan Carpenter 4 participants 6 messages Jun 21, 2013 – Jun 24, 2013

Subsystems (4)
Networking Network drivers Kernel janitors Xen network backend driver
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 xen-netback: double free on unload

There is a typo here, "i" vs "j", so we would crash on module_exit().

Signed-off-by Dan Carpenter <[email protected]>
drivers/net/xen-netback/netback.c +2 -2
index a0b50ad..130bcb2 100644
@@ -1968,8 +1968,8 @@ static void __exit netback_fini(void)
 		del_timer_sync(&netbk->net_timer);
 		kthread_stop(netbk->task);
 		for (j = 0; j < MAX_PENDING_REQS; j++) {
-			if (netbk->mmap_pages[i])
-				__free_page(netbk->mmap_pages[i]);
+			if (netbk->mmap_pages[j])
+				__free_page(netbk->mmap_pages[j]);
 		}
 	}
#1 lore raw
Quoted 9 lines · Dan Carpenter

There is a typo here, "i" vs "j", so we would crash on module_exit().

Signed-off-by Dan Carpenter <[email protected]>
drivers/net/xen-netback/netback.c +0 -0
index a0b50ad..130bcb2 100644

drivers/net/xen-netback/netback.c static void __exit netback_fini(void) · line 1972

Quoted 7 lines
drivers/net/xen-netback/netback.c +2 -2
@@ -1968,8 +1968,8 @@ static void __exit netback_fini(void)
 		del_timer_sync(&netbk->net_timer);
 		kthread_stop(netbk->task);
 		for (j = 0; j < MAX_PENDING_REQS; j++) {
-			if (netbk->mmap_pages[i])
-				__free_page(netbk->mmap_pages[i]);
+			if (netbk->mmap_pages[j])
+				__free_page(netbk->mmap_pages[j]);

Nice catch, thanks.

Wei.

maintainer
#2 lore raw
In reply to Dan Carpenter

From: Dan Carpenter <[email protected]>
Date: Fri, 21 Jun 2013 09:20:08 +0300

Quoted 3 lines

There is a typo here, "i" vs "j", so we would crash on module_exit().

Signed-off-by Dan Carpenter <[email protected]>

Please always explicitly state the tree for which a patch is applicable.

Here I figured it out by trial an error, trying to apply it to 'net' (where it failed) and then 'net-next' (where it applied cleanly).

I should never have to play patch monkey games like that, you need to tell me where a patch is targetted.

Thanks.

#3 lore raw
Quoted 10 lines · David Miller

From: Dan Carpenter <[email protected]>
Date: Fri, 21 Jun 2013 09:20:08 +0300

Quoted 3 lines

There is a typo here, "i" vs "j", so we would crash on module_exit().

Signed-off-by Dan Carpenter <[email protected]>

Please always explicitly state the tree for which a patch is applicable.

Quoted 6 lines

Here I figured it out by trial an error, trying to apply it to 'net' (where it failed) and then 'net-next' (where it applied cleanly).

I should never have to play patch monkey games like that, you need to tell me where a patch is targetted.

Shouldn't one always, by default, work on linux-next?

julia

maintainer
#4 lore raw

From: Julia Lawall <[email protected]>
Date: Mon, 24 Jun 2013 08:31:31 +0100 (BST)

Quoted 12 lines · David Miller
Quoted 11 lines

From: Dan Carpenter <[email protected]>
Date: Fri, 21 Jun 2013 09:20:08 +0300

Quoted 3 lines

There is a typo here, "i" vs "j", so we would crash on module_exit().

Signed-off-by Dan Carpenter <[email protected]>

Please always explicitly state the tree for which a patch is applicable.

Quoted 8 lines
Quoted 6 lines

Here I figured it out by trial an error, trying to apply it to 'net' (where it failed) and then 'net-next' (where it applied cleanly).

I should never have to play patch monkey games like that, you need to tell me where a patch is targetted.

Shouldn't one always, by default, work on linux-next?

Bug fixes, especially serious ones, should be targetted at 'net'.