Skip to contentSkip to conversation

smatch stuff: use after free bug

DISCUSSION Dan Carpenter 2 participants 2 messages Mar 28, 2011

Subsystems (2)
lore
Share & tools
lore
#0 lore raw

Smatch complains about this. It's not obvious to me how to fix it. The bug was introduced in b12d93d63 "mlx4: Add support for promiscuous mode in the new steering model.".

drivers/net/mlx4/mcg.c +530
remove_promisc_qp(89) warn: 'pqp' was already freed.

   526  out_mailbox:
   527          mlx4_free_cmd_mailbox(dev, mailbox);
   528  out_list:
   529          if (back_to_list)
   530                  list_add_tail(&pqp->list, &s_steer->promisc_qps[steer]);
                                      ^^^^^^^^^^

This list was deleted and pqp was freed at this point.

   531  out_mutex:
   532          mutex_unlock(&priv->mcg_table.mutex);
   533          return err;
   534  }

regards,
dan carpenter

#1 lore raw
Quoted 6 lines

Subject: smatch stuff: use after free bug

Smatch complains about this. It's not obvious to me how to fix it. The
bug was introduced in b12d93d63 "mlx4: Add support for promiscuous mode in the new steering model.".

Thanks,
Will send a fix.

Yevgeny