From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1756338AbcBHVSZ (ORCPT <rfc822;w@1wt.eu>);
	Mon, 8 Feb 2016 16:18:25 -0500
Received: from mail.linuxfoundation.org ([140.211.169.12]:35222 "EHLO
	mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1755114AbcBHVSX (ORCPT
	<rfc822;linux-kernel@vger.kernel.org>);
	Mon, 8 Feb 2016 16:18:23 -0500
Date: Mon, 8 Feb 2016 13:18:22 -0800
From: Andrew Morton <akpm@linux-foundation.org>
To: Alexandre Bounine <alexandre.bounine@idt.com>
Cc: Matt Porter <mporter@kernel.crashing.org>,
        Aurelien Jacquiot <a-jacquiot@ti.com>,
        Andre van Herk <andre.van.herk@prodrive-technologies.com>,
        linux-kernel@vger.kernel.org
Subject: Re: [PATCH 22/30] rapidio: add global inbound port write interfaces
Message-Id: <20160208131822.d86eea501587ae3281cc84ed@linux-foundation.org>
In-Reply-To: <1454714386-15259-23-git-send-email-alexandre.bounine@idt.com>
References: <1454714386-15259-1-git-send-email-alexandre.bounine@idt.com>
	<1454714386-15259-23-git-send-email-alexandre.bounine@idt.com>
X-Mailer: Sylpheed 3.4.1 (GTK+ 2.24.23; x86_64-pc-linux-gnu)
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Fri,  5 Feb 2016 18:19:38 -0500 Alexandre Bounine <alexandre.bounine@idt.com> wrote:

> +int rio_del_mport_pw_handler(struct rio_mport *mport, void *context,
> +			     int (*pwcback)(struct rio_mport *mport,
> +			     void *context, union rio_pw_msg *msg, int step))
> +{
> +	int rc = -EINVAL;
> +	struct rio_pwrite *pwrite;
> +
> +	mutex_lock(&mport->lock);
> +	list_for_each_entry(pwrite, &mport->pwrites, node) {

You have a use-after-free here - list_for_each_entry() references the
pwrite_node_next which was freed on the previous loop.

I'll switch this to list_for_each_entry_safe.  Please test that change
and review the other patches for reoccurrences.

> +		if (pwrite->pwcback == pwcback && pwrite->context == context) {
> +			list_del(&pwrite->node);
> +			kfree(pwrite);
> +			rc = 0;
> +			break;
> +		}
> +	}
> +	mutex_unlock(&mport->lock);
> +
> +	return rc;
> +}
> +EXPORT_SYMBOL_GPL(rio_del_mport_pw_handler);