The patch titled mm/dmapool.c: fix possible use after free in dmam_pool_destroy() has been removed from the -mm tree. Its filename was mm-dmapool-fix-possible-use-after-free-in-dmam_pool_destroy.patch This patch was dropped because an updated version will be merged The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/ ------------------------------------------------------ Subject: mm/dmapool.c: fix possible use after free in dmam_pool_destroy() From: Maxin B John <maxin.john@xxxxxxxxx> "dma_pool_destroy(pool)" calls "kfree(pool)". The freed pointer "pool" is again passed as an argument to the function "devres_destroy()". This patch fixes the possible use after free. It's notabug at this time, but the code is dangerous. Signed-off-by: Maxin B. John <maxin.john@xxxxxxxxx> Cc: Rolf Eike Beer <eike-kernel@xxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- mm/dmapool.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff -puN mm/dmapool.c~mm-dmapool-fix-possible-use-after-free-in-dmam_pool_destroy mm/dmapool.c --- a/mm/dmapool.c~mm-dmapool-fix-possible-use-after-free-in-dmam_pool_destroy +++ a/mm/dmapool.c @@ -500,7 +500,7 @@ void dmam_pool_destroy(struct dma_pool * { struct device *dev = pool->dev; - dma_pool_destroy(pool); WARN_ON(devres_destroy(dev, dmam_pool_release, dmam_pool_match, pool)); + dma_pool_destroy(pool); } EXPORT_SYMBOL(dmam_pool_destroy); _ Patches currently in -mm which might be from maxin.john@xxxxxxxxx are linux-next.patch devres-fix-possible-use-after-free.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html