From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752469AbcFFPPK (ORCPT ); Mon, 6 Jun 2016 11:15:10 -0400 Received: from mail-wm0-f47.google.com ([74.125.82.47]:35730 "EHLO mail-wm0-f47.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751667AbcFFPPH (ORCPT ); Mon, 6 Jun 2016 11:15:07 -0400 Date: Mon, 6 Jun 2016 16:15:39 +0100 From: Lee Jones To: Sudeep Holla Cc: Jassi Brar , linux-kernel@vger.kernel.org, Jassi Brar Subject: Re: [PATCH] mailbox: mailbox-test: set tdev->signal to NULL after freeing Message-ID: <20160606151539.GD1525@dell> References: <1464106324-25005-1-git-send-email-sudeep.holla@arm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <1464106324-25005-1-git-send-email-sudeep.holla@arm.com> User-Agent: Mutt/1.5.24 (2015-08-30) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, 24 May 2016, Sudeep Holla wrote: > tdev->signal is not set NULL after it's freed. This will cause random > exceptions when the stale pointer is accessed after tdev->signal is > freed. Also, since tdev->signal allocation is skipped the next time > it's written, this leads to continuous fault finally leading to the > total death of the system. > > Cc: Lee Jones > Cc: Jassi Brar > Fixes: d1c2f87c9a8f ("mailbox: mailbox-test: Prevent memory leak") > Signed-off-by: Sudeep Holla > --- > drivers/mailbox/mailbox-test.c | 1 + > 1 file changed, 1 insertion(+) Strange there isn't a kfree_and_null() call. Patch looks okay to me though: Acked-by: Lee Jones > diff --git a/drivers/mailbox/mailbox-test.c b/drivers/mailbox/mailbox-test.c > index 58d04726cdd7..9ca96e9db6bf 100644 > --- a/drivers/mailbox/mailbox-test.c > +++ b/drivers/mailbox/mailbox-test.c > @@ -133,6 +133,7 @@ static ssize_t mbox_test_message_write(struct file *filp, > out: > kfree(tdev->signal); > kfree(tdev->message); > + tdev->signal = NULL; > > return ret < 0 ? ret : count; > } -- Lee Jones Linaro STMicroelectronics Landing Team Lead Linaro.org │ Open source software for ARM SoCs Follow Linaro: Facebook | Twitter | Blog