Re: [Bugme-new] [Bug 8107] New: dev->header_cache_update has a random value

[Stephen Hemminger <shemminger@linux-foundation.org>]

On Thu, 1 Mar 2007 14:34:17 -0800
Andrew Morton <akpm@linux-foundation.org> wrote:

> On Thu, 1 Mar 2007 11:33:05 -0800
> bugme-daemon@bugzilla.kernel.org wrote:
> 
> > http://bugzilla.kernel.org/show_bug.cgi?id=8107
> > 
> >            Summary: dev->header_cache_update has a random value
> >     Kernel Version: 2.6.20
> >             Status: NEW
> >           Severity: high
> >              Owner: jgarzik@pobox.com
> >          Submitter: loveminix@yahoo.com.cn
> > 
> > 
> > Distribution: Kernel 2.6.20
> > 
> > Problem Description:
> > 
> > In struct net_device, there are two fields: hard_header_cache and 
> > header_cache_update, both of which are function pointers. The third field, 
> > hard_header, is also a function pointer. Whenever hard_header points to a valid 
> > function, both hard_header_cache and header_cache_update should have a known 
> > value, either NULL or a valid function pointer. However, in 
> > drivers/net/wan/hdlc_cisco.c, in function static int cisco_ioctl(struct 
> > net_device *dev, struct ifreq *ifr), where dev->hard_header is assigned a valid 
> > function, and dev->hard_header_cache is assigned a known value (NULL), dev-
> > >header_cache_update is not set to a known value:
> > 
> > dev->hard_start_xmit = hdlc->xmit;
> >         dev->hard_header = cisco_hard_header;
> >         dev->hard_header_cache = NULL;
> >         dev->type = ARPHRD_CISCO;
> >         dev->flags = IFF_POINTOPOINT | IFF_NOARP;
> >         dev->addr_len = 0;
> > 
> > This may cause serious problems when dev->header_cache_update is invoked, 
> > because it has an uninitialized value.
> > 
> > Steps to reproduce:
> > 
> > I found this suspicious spot with the help of a code-checking tool.
> > 
> 
> Like this?

Not necessary, since any network device must already allocated by
alloc_netdev() and it initializes the whole struct to 0 (NULL).

-- 
Stephen Hemminger <shemminger@linux-foundation.org>