Search Linux Wireless

Re: [PATCH -next] netdevice zd1201: Use after free

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, Dec 18, 2008 at 02:53:31PM +0800, Wang Chen wrote:
> | commit 3d29b0c33d431ecc69ec778f8c236d382f59a85f
> | Author: John W. Linville <linville@xxxxxxxxxxxxx>
> | Date:   Fri Oct 31 14:13:12 2008 -0400
> | 
> |     netdevice zd1201: Convert directly reference of netdev->priv to netdev_priv()
> | 
> |     We have some reasons to kill netdev->priv:
> |     1. netdev->priv is equal to netdev_priv().
> |     2. netdev_priv() wraps the calculation of netdev->priv's offset, obviously
> |        netdev_priv() is more flexible than netdev->priv.
> |     But we cann't kill netdev->priv, because so many drivers reference to it
> |     directly.
> | 
> |     OK, becasue Dave S. Miller said, "every direct netdev->priv usage is a bug",
> |     and I want to kill netdev->priv later, I decided to convert all the direct
> |     reference of netdev->priv first.
> | 
> |     (Original patch posted by Wang Chen <wangchen@xxxxxxxxxxxxxx> w/ above
> |     changelog but using dev->ml_priv.  That doesn't seem appropriate
> |     to me for this driver, so I've revamped it to use netdev_priv()
> |     instead. -- JWL)
> 
> This commit changed the allocation of netdev, but didn't change
> the free method of it.
> This causes "zd" be used after the memory, which is pointed by "zd", being
> freed by free_netdev().

Oops...thanks!

John
-- 
John W. Linville		Linux should be at the core
linville@xxxxxxxxxxxxx			of your literate lifestyle.
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[Index of Archives]     [Linux Host AP]     [ATH6KL]     [Linux Bluetooth]     [Linux Netdev]     [Kernel Newbies]     [Linux Kernel]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Samba]     [Device Mapper]
  Powered by Linux