Date: Sat, 23 Aug 2003 00:19:22 -0700
From: Andrew Morton <akpm@osdl.org>
To: Dmitry Torokhov <dtor_core@ameritech.net>
Cc: linux-kernel@vger.kernel.org, vojtech@suse.cz
Subject: Re: [PATCH 2.6] 2/3 Serio: possible race in handle_events
Message-Id: <20030823001922.487f83f5.akpm@osdl.org>
In-Reply-To: <200308230206.25142.dtor_core@ameritech.net>
References: <200308230131.45474.dtor_core@ameritech.net>
	<20030823000008.07050a75.akpm@osdl.org>
	<200308230206.25142.dtor_core@ameritech.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1138
Lines: 36

Dmitry Torokhov <dtor_core@ameritech.net> wrote:
>
> On Saturday 23 August 2003 02:00 am, Andrew Morton wrote:
> > Dmitry Torokhov <dtor_core@ameritech.net> wrote:
> > > +static int is_known_serio(struct serio *serio)
> > >  +{
> > >  +	struct serio *s;
> > >  +
> > >  +	list_for_each_entry(s, &serio_list, node)
> > >  +		if (s == serio)
> > >  +			return 1;
> > >  +	return 0;
> > >  +}
> >
> > Could this just be
> >
> > 	return !list_empty(&serio->node);
> >
> > ?
> 
> The serio could be free()d, I dont think we want to call list_empty with 
> a dangling pointer. Or am I missing something?
> 

Well if we're playing around with a freed pointer then something is
seriously wrong.  Like, someone could have allocated a new one and got the
same address.

If event->serio can point at freed memory and there's any doubt over it
then we should be nulling out event->serio to indicate that.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/