Re: [PATCH v5 3.1.0-rc4-tip 1/26] uprobes: Auxillary routines toinsert, find, delete uprobes

[Peter Zijlstra]

On Tue, 2011-09-20 at 16:42 +0100, Stefan Hajnoczi wrote:
> On Tue, Sep 20, 2011 at 05:29:49PM +0530, Srikar Dronamraju wrote:
> > +static void delete_uprobe(struct uprobe *uprobe)
> > +{
> > +	unsigned long flags;
> > +
> > +	spin_lock_irqsave(&uprobes_treelock, flags);
> > +	rb_erase(&uprobe->rb_node, &uprobes_tree);
> > +	spin_unlock_irqrestore(&uprobes_treelock, flags);
> > +	put_uprobe(uprobe);
> > +	iput(uprobe->inode);
> 
> Use-after-free when put_uprobe() kfrees() the uprobe?

I suspect the caller still has one, and this was the reference for being
part of the tree. But yes, that could do with a comment.

The comment near atomic_set() in __insert_uprobe() isn't too clear
either. /* get access + drop ref */, would naively seem +1 -1 = 0,
instead of +1 +1 = 2.


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/