* [PATCH 1/2] NTB: fix access of free-ed pointer
@ 2015-10-03 8:09 Sudip Mukherjee
2015-10-03 8:09 ` [PATCH 2/2] NTB: remove unused variable Sudip Mukherjee
2015-10-05 2:37 ` [PATCH 1/2] NTB: fix access of free-ed pointer Jon Mason
0 siblings, 2 replies; 4+ messages in thread
From: Sudip Mukherjee @ 2015-10-03 8:09 UTC (permalink / raw)
To: Jon Mason, Dave Jiang, Allen Hubbe
Cc: linux-kernel, linux-ntb, Sudip Mukherjee
We were accessing nt->mw_vec after freeing it. Fix the error path so
that we free nt->mw_vec after we have finished using it.
Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org>
---
drivers/ntb/ntb_transport.c | 15 +++++++--------
1 file changed, 7 insertions(+), 8 deletions(-)
diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
index 6e3ee90..69953ee 100644
--- a/drivers/ntb/ntb_transport.c
+++ b/drivers/ntb/ntb_transport.c
@@ -1080,7 +1080,7 @@ static int ntb_transport_probe(struct ntb_client *self, struct ntb_dev *ndev)
GFP_KERNEL, node);
if (!nt->qp_vec) {
rc = -ENOMEM;
- goto err2;
+ goto err1;
}
if (nt_debugfs_dir) {
@@ -1092,7 +1092,7 @@ static int ntb_transport_probe(struct ntb_client *self, struct ntb_dev *ndev)
for (i = 0; i < qp_count; i++) {
rc = ntb_transport_init_queue(nt, i);
if (rc)
- goto err3;
+ goto err2;
}
INIT_DELAYED_WORK(&nt->link_work, ntb_transport_link_work);
@@ -1100,12 +1100,12 @@ static int ntb_transport_probe(struct ntb_client *self, struct ntb_dev *ndev)
rc = ntb_set_ctx(ndev, nt, &ntb_transport_ops);
if (rc)
- goto err3;
+ goto err2;
INIT_LIST_HEAD(&nt->client_devs);
rc = ntb_bus_init(nt);
if (rc)
- goto err4;
+ goto err3;
nt->link_is_up = false;
ntb_link_enable(ndev, NTB_SPEED_AUTO, NTB_WIDTH_AUTO);
@@ -1113,17 +1113,16 @@ static int ntb_transport_probe(struct ntb_client *self, struct ntb_dev *ndev)
return 0;
-err4:
- ntb_clear_ctx(ndev);
err3:
- kfree(nt->qp_vec);
+ ntb_clear_ctx(ndev);
err2:
- kfree(nt->mw_vec);
+ kfree(nt->qp_vec);
err1:
while (i--) {
mw = &nt->mw_vec[i];
iounmap(mw->vbase);
}
+ kfree(nt->mw_vec);
err:
kfree(nt);
return rc;
--
1.9.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH 2/2] NTB: remove unused variable
2015-10-03 8:09 [PATCH 1/2] NTB: fix access of free-ed pointer Sudip Mukherjee
@ 2015-10-03 8:09 ` Sudip Mukherjee
2015-10-05 2:48 ` Jon Mason
2015-10-05 2:37 ` [PATCH 1/2] NTB: fix access of free-ed pointer Jon Mason
1 sibling, 1 reply; 4+ messages in thread
From: Sudip Mukherjee @ 2015-10-03 8:09 UTC (permalink / raw)
To: Jon Mason, Dave Jiang, Allen Hubbe
Cc: linux-kernel, linux-ntb, Sudip Mukherjee
These variables were not used anywhere. So remove them.
Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org>
---
drivers/ntb/ntb_transport.c | 4 ----
1 file changed, 4 deletions(-)
diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
index 69953ee..28f9a03 100644
--- a/drivers/ntb/ntb_transport.c
+++ b/drivers/ntb/ntb_transport.c
@@ -928,7 +928,6 @@ static int ntb_transport_init_queue(struct ntb_transport_ctx *nt,
unsigned int qp_num)
{
struct ntb_transport_qp *qp;
- struct ntb_transport_mw *mw;
phys_addr_t mw_base;
resource_size_t mw_size;
unsigned int num_qps_mw, tx_size;
@@ -939,7 +938,6 @@ static int ntb_transport_init_queue(struct ntb_transport_ctx *nt,
qp_count = nt->qp_count;
mw_num = QP_TO_MW(nt, qp_num);
- mw = &nt->mw_vec[mw_num];
qp = &nt->qp_vec[qp_num];
qp->qp_num = qp_num;
@@ -1930,13 +1928,11 @@ EXPORT_SYMBOL_GPL(ntb_transport_link_up);
*/
void ntb_transport_link_down(struct ntb_transport_qp *qp)
{
- struct pci_dev *pdev;
int val;
if (!qp)
return;
- pdev = qp->ndev->pdev;
qp->client_ready = false;
val = ntb_spad_read(qp->ndev, QP_LINKS);
--
1.9.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH 1/2] NTB: fix access of free-ed pointer
2015-10-03 8:09 [PATCH 1/2] NTB: fix access of free-ed pointer Sudip Mukherjee
2015-10-03 8:09 ` [PATCH 2/2] NTB: remove unused variable Sudip Mukherjee
@ 2015-10-05 2:37 ` Jon Mason
1 sibling, 0 replies; 4+ messages in thread
From: Jon Mason @ 2015-10-05 2:37 UTC (permalink / raw)
To: Sudip Mukherjee; +Cc: Dave Jiang, Allen Hubbe, linux-kernel, linux-ntb
On Sat, Oct 3, 2015 at 4:09 AM, Sudip Mukherjee
<sudipm.mukherjee@gmail.com> wrote:
> We were accessing nt->mw_vec after freeing it. Fix the error path so
> that we free nt->mw_vec after we have finished using it.
>
> Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org>
Good catch. Pulled into my ntb branch.
Thanks,
Jon
> ---
> drivers/ntb/ntb_transport.c | 15 +++++++--------
> 1 file changed, 7 insertions(+), 8 deletions(-)
>
> diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
> index 6e3ee90..69953ee 100644
> --- a/drivers/ntb/ntb_transport.c
> +++ b/drivers/ntb/ntb_transport.c
> @@ -1080,7 +1080,7 @@ static int ntb_transport_probe(struct ntb_client *self, struct ntb_dev *ndev)
> GFP_KERNEL, node);
> if (!nt->qp_vec) {
> rc = -ENOMEM;
> - goto err2;
> + goto err1;
> }
>
> if (nt_debugfs_dir) {
> @@ -1092,7 +1092,7 @@ static int ntb_transport_probe(struct ntb_client *self, struct ntb_dev *ndev)
> for (i = 0; i < qp_count; i++) {
> rc = ntb_transport_init_queue(nt, i);
> if (rc)
> - goto err3;
> + goto err2;
> }
>
> INIT_DELAYED_WORK(&nt->link_work, ntb_transport_link_work);
> @@ -1100,12 +1100,12 @@ static int ntb_transport_probe(struct ntb_client *self, struct ntb_dev *ndev)
>
> rc = ntb_set_ctx(ndev, nt, &ntb_transport_ops);
> if (rc)
> - goto err3;
> + goto err2;
>
> INIT_LIST_HEAD(&nt->client_devs);
> rc = ntb_bus_init(nt);
> if (rc)
> - goto err4;
> + goto err3;
>
> nt->link_is_up = false;
> ntb_link_enable(ndev, NTB_SPEED_AUTO, NTB_WIDTH_AUTO);
> @@ -1113,17 +1113,16 @@ static int ntb_transport_probe(struct ntb_client *self, struct ntb_dev *ndev)
>
> return 0;
>
> -err4:
> - ntb_clear_ctx(ndev);
> err3:
> - kfree(nt->qp_vec);
> + ntb_clear_ctx(ndev);
> err2:
> - kfree(nt->mw_vec);
> + kfree(nt->qp_vec);
> err1:
> while (i--) {
> mw = &nt->mw_vec[i];
> iounmap(mw->vbase);
> }
> + kfree(nt->mw_vec);
> err:
> kfree(nt);
> return rc;
> --
> 1.9.1
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH 2/2] NTB: remove unused variable
2015-10-03 8:09 ` [PATCH 2/2] NTB: remove unused variable Sudip Mukherjee
@ 2015-10-05 2:48 ` Jon Mason
0 siblings, 0 replies; 4+ messages in thread
From: Jon Mason @ 2015-10-05 2:48 UTC (permalink / raw)
To: Sudip Mukherjee; +Cc: Dave Jiang, Allen Hubbe, linux-kernel, linux-ntb
On Sat, Oct 3, 2015 at 4:09 AM, Sudip Mukherjee
<sudipm.mukherjee@gmail.com> wrote:
> These variables were not used anywhere. So remove them.
>
> Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org>
Applied.
Thanks,
Jon
> ---
> drivers/ntb/ntb_transport.c | 4 ----
> 1 file changed, 4 deletions(-)
>
> diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
> index 69953ee..28f9a03 100644
> --- a/drivers/ntb/ntb_transport.c
> +++ b/drivers/ntb/ntb_transport.c
> @@ -928,7 +928,6 @@ static int ntb_transport_init_queue(struct ntb_transport_ctx *nt,
> unsigned int qp_num)
> {
> struct ntb_transport_qp *qp;
> - struct ntb_transport_mw *mw;
> phys_addr_t mw_base;
> resource_size_t mw_size;
> unsigned int num_qps_mw, tx_size;
> @@ -939,7 +938,6 @@ static int ntb_transport_init_queue(struct ntb_transport_ctx *nt,
> qp_count = nt->qp_count;
>
> mw_num = QP_TO_MW(nt, qp_num);
> - mw = &nt->mw_vec[mw_num];
>
> qp = &nt->qp_vec[qp_num];
> qp->qp_num = qp_num;
> @@ -1930,13 +1928,11 @@ EXPORT_SYMBOL_GPL(ntb_transport_link_up);
> */
> void ntb_transport_link_down(struct ntb_transport_qp *qp)
> {
> - struct pci_dev *pdev;
> int val;
>
> if (!qp)
> return;
>
> - pdev = qp->ndev->pdev;
> qp->client_ready = false;
>
> val = ntb_spad_read(qp->ndev, QP_LINKS);
> --
> 1.9.1
>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2015-10-05 2:48 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-10-03 8:09 [PATCH 1/2] NTB: fix access of free-ed pointer Sudip Mukherjee
2015-10-03 8:09 ` [PATCH 2/2] NTB: remove unused variable Sudip Mukherjee
2015-10-05 2:48 ` Jon Mason
2015-10-05 2:37 ` [PATCH 1/2] NTB: fix access of free-ed pointer Jon Mason
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).