2008-02-20 00:59:46

by Adrian Bunk

[permalink] [raw]
Subject: infiniband/hw/nes/nes_cm.c: use-after-free

Spotted by the Coverity checker.

<-- snip -->

...
static int mini_cm_dec_refcnt_listen(struct nes_cm_core *cm_core,
struct nes_cm_listener *listener, int free_hanging_nodes)
{
int ret = 1;
unsigned long flags;
spin_lock_irqsave(&cm_core->listen_list_lock, flags);
if (!atomic_dec_return(&listener->ref_count)) {
list_del(&listener->list);

/* decrement our listen node count */
atomic_dec(&cm_core->listen_node_cnt);

spin_unlock_irqrestore(&cm_core->listen_list_lock, flags);

if (listener->nesvnic) {
nes_manage_apbvt(listener->nesvnic, listener->loc_port,
PCI_FUNC(listener->nesvnic->nesdev->pcidev->devfn), NES_MANAGE_APBVT_DEL);
}

nes_debug(NES_DBG_CM, "destroying listener (%p)\n", listener);

kfree(listener); <----------------------------------
ret = 0;
cm_listens_destroyed++;
} else {
spin_unlock_irqrestore(&cm_core->listen_list_lock, flags);
}
if (listener) {
if (atomic_read(&listener->pend_accepts_cnt) > 0)
... ^^^^^^^^^^^^^^^^^^^^^^^^^^

<-- snip -->

cu
Adrian

--

"Is there not promise of rain?" Ling Tan asked suddenly out
of the darkness. There had been need of rain for many days.
"Only a promise," Lao Er said.
Pearl S. Buck - Dragon Seed