* Peter Zijlstra [off-list ref] [2011-09-26 13:18:38]:

On Tue, 2011-09-20 at 16:42 +0100, Stefan Hajnoczi wrote:

quoted

On Tue, Sep 20, 2011 at 05:29:49PM +0530, Srikar Dronamraju wrote:

quoted

+static void delete_uprobe(struct uprobe *uprobe)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&uprobes_treelock, flags);
+	rb_erase(&uprobe->rb_node, &uprobes_tree);
+	spin_unlock_irqrestore(&uprobes_treelock, flags);
+	put_uprobe(uprobe);
+	iput(uprobe->inode);

Use-after-free when put_uprobe() kfrees() the uprobe?

I suspect the caller still has one, and this was the reference for being
part of the tree. But yes, that could do with a comment.

Yes, the caller has a reference, However I went ahead and changed the
order of the last two statements.

The comment near atomic_set() in __insert_uprobe() isn't too clear
either. /* get access + drop ref */, would naively seem +1 -1 = 0,
instead of +1 +1 = 2.

Okay, Have modified the comment to /* get access + creation ref */

-- 
Thanks and Regards
Srikar

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Fight unfair telecom internet charges in Canada: sign http://stopthemeter.ca/
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>