| Message ID | 81bc171fb2246201236c341e9b7d799f509d7dd4.1714690906.git.duoming@zju.edu.cn (mailing list archive) |
|---|---|
| State | Changes Requested |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | ax25: fix reference counting issue of ax25_dev | expand |
> The ax25_dev is managed by reference counting, so it should not be > deallocated directly by kfree() in ax25_dev_free(), replace it with > ax25_dev_put() instead. You repeated a wording mistake in the summary phrase from a previous cover letter. Please avoid confusion about desired code replacements. How do you think about to append parentheses to involved function names? Would you find the following change description a bit nicer? The object “ax25_dev” is managed by reference counting. Thus it should not be directly released by a kfree() call in ax25_dev_free(). Replace it with a ax25_dev_put() call instead. Would you like to extend patch version descriptions (or changelogs) accordingly? Regards, Markus
On Fri, May 03, 2024 at 07:36:54AM +0200, Markus Elfring wrote: > > The ax25_dev is managed by reference counting, so it should not be > > deallocated directly by kfree() in ax25_dev_free(), replace it with > > ax25_dev_put() instead. > > You repeated a wording mistake in the summary phrase from a previous cover letter. Yeah. That's true. The subject should be changed to: Subject: [PATCH] ax25: change kfree() in ax25_dev_free() to ax25_dev_put() Another option would be: Subject: [PATCH] ax25: use ax25_dev_put() in ax25_dev_free() Otherwise the commit message is okay as-is. regards, dan carpenter
diff --git a/net/ax25/ax25_dev.c b/net/ax25/ax25_dev.c index 282ec581c07..07723095c60 100644 --- a/net/ax25/ax25_dev.c +++ b/net/ax25/ax25_dev.c @@ -208,7 +208,7 @@ void __exit ax25_dev_free(void) s = ax25_dev; netdev_put(ax25_dev->dev, &ax25_dev->dev_tracker); ax25_dev = ax25_dev->next; - kfree(s); + ax25_dev_put(s); } ax25_dev_list = NULL; spin_unlock_bh(&ax25_dev_lock);
The ax25_dev is managed by reference counting, so it should not be deallocated directly by kfree() in ax25_dev_free(), replace it with ax25_dev_put() instead. Fixes: d01ffb9eee4a ("ax25: add refcount in ax25_dev to avoid UAF bugs") Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> --- net/ax25/ax25_dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)