Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751941Ab3JSLiq (ORCPT ); Sat, 19 Oct 2013 07:38:46 -0400 Received: from mail-ie0-f176.google.com ([209.85.223.176]:62544 "EHLO mail-ie0-f176.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751281Ab3JSLio convert rfc822-to-8bit (ORCPT ); Sat, 19 Oct 2013 07:38:44 -0400 MIME-Version: 1.0 Date: Sat, 19 Oct 2013 08:38:43 -0300 Message-ID: Subject: net: sctp: possible dereference after freeing From: =?UTF-8?Q?Geyslan_Greg=C3=B3rio_Bem?= To: Vlad Yasevich Cc: Neil Horman , "David S. Miller" , linux-sctp@vger.kernel.org, netdev@vger.kernel.org, LKML Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8BIT Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 843 Lines: 35 Hi maintainers, I would like to know if these are catches: /net/sctp/endpointola.c (281) static void sctp_endpoint_destroy(struct sctp_endpoint *ep) { struct sock *sk; ... kfree(ep); SCTP_DBG_OBJCNT_DEC(ep); } The 'ep' object counter is being decremented?! Is the kfree to be there indeed? Let me know what was intended here. Same here: /net/sctp/endpointola.c (165) static void sctp_transport_destroy_rcu(struct rcu_head *head) { struct sctp_transport *transport; ... kfree(transport); SCTP_DBG_OBJCNT_DEC(transport); } Regards, Geyslan Gregório Bem hackingbits.com -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/