Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755487AbbLBKfX (ORCPT ); Wed, 2 Dec 2015 05:35:23 -0500 Received: from smtp02.citrix.com ([66.165.176.63]:14172 "EHLO SMTP02.CITRIX.COM" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754967AbbLBKfV (ORCPT ); Wed, 2 Dec 2015 05:35:21 -0500 X-IronPort-AV: E=Sophos;i="5.20,372,1444694400"; d="scan'208";a="321952971" Message-ID: <565EC964.3020006@citrix.com> Date: Wed, 2 Dec 2015 10:35:16 +0000 From: David Vrabel User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Icedove/31.8.0 MIME-Version: 1.0 To: Doug Goldstein , CC: , Bob Liu , Paul Durrant , Wei Liu , Boris Ostrovsky , Konrad Rzeszutek Wilk , Jonathan Creekmore Subject: Re: [PATCH] xen-pciback: fix up cleanup path when alloc fails References: <1448569959-7245-1-git-send-email-cardoe@cardoe.com> In-Reply-To: <1448569959-7245-1-git-send-email-cardoe@cardoe.com> Content-Type: text/plain; charset="windows-1252" Content-Transfer-Encoding: 7bit X-DLP: MIA2 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 799 Lines: 25 On 26/11/15 20:32, Doug Goldstein wrote: > When allocating a pciback device fails, avoid the possibility of a > use after free. We should not require clearing drvdata for correctness. We should ensure we retain drvdata for as long as it is needed. I note that pcistub_device_release() has: kfree(dev_data); pci_set_drvdata(dev, NULL); /* Clean-up the device */ xen_pcibk_config_free_dyn_fields(dev); xen_pcibk_config_free_dev(dev); Which should (at a minimum) be reordered to move the kfree(dev_data) to after the calls that require it David -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/