Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752507Ab3JSLtO (ORCPT ); Sat, 19 Oct 2013 07:49:14 -0400 Received: from mail-ie0-f176.google.com ([209.85.223.176]:58502 "EHLO mail-ie0-f176.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751588Ab3JSLtM convert rfc822-to-8bit (ORCPT ); Sat, 19 Oct 2013 07:49:12 -0400 MIME-Version: 1.0 In-Reply-To: References: Date: Sat, 19 Oct 2013 08:49:10 -0300 Message-ID: Subject: Re: net: sctp: possible dereference after freeing From: =?UTF-8?Q?Geyslan_Greg=C3=B3rio_Bem?= To: Vlad Yasevich Cc: Neil Horman , "David S. Miller" , linux-sctp@vger.kernel.org, netdev@vger.kernel.org, LKML Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8BIT Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1198 Lines: 45 2013/10/19 Geyslan Gregório Bem : > Hi maintainers, > > I would like to know if these are catches: > > /net/sctp/endpointola.c (281) > static void sctp_endpoint_destroy(struct sctp_endpoint *ep) > { > struct sock *sk; > ... > kfree(ep); > SCTP_DBG_OBJCNT_DEC(ep); > } > > The 'ep' object counter is being decremented?! Is the kfree to be there indeed? > Let me know what was intended here. > > Same here: > /net/sctp/endpointola.c (165) > static void sctp_transport_destroy_rcu(struct rcu_head *head) > { > struct sctp_transport *transport; > ... > kfree(transport); > SCTP_DBG_OBJCNT_DEC(transport); > } > > Regards, > > Geyslan Gregório Bem > hackingbits.com Oops. I got it. ;) extern atomic_t sctp_dbg_objcnt_ep; http://lxr.free-electrons.com/source/include/net/sctp/sctp.h#L269 extern atomic_t sctp_dbg_objcnt_transport; http://lxr.free-electrons.com/source/arch/x86/include/asm/atomic.h#L105 Cheers. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/