From: Charan Teja Kalla
Sent: 17 June 2020 07:29
...
If name is freed you will copy garbage, but the only way for that to happen is that _set_name or _release have to be called at just the right time.
And the above would probably only be an issue if the set_name was called, so you will get NULL or a real name.
And there exists a use-after-free to avoid which requires the lock. Say that memcpy() in dmabuffs_dname is in progress and in parallel _set_name will free the same buffer that memcpy is operating on.
If the name is being looked at while the item is being freed you almost certainly have much bigger problems that just the name being a 'junk' pointer.
David.
- Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK Registration No: 1397386 (Wales)