Re: [PATCH -next] netdevice zd1201: Use after free

["John W. Linville" <linville@tuxdriver.com>]

On Thu, Dec 18, 2008 at 02:53:31PM +0800, Wang Chen wrote:
> | commit 3d29b0c33d431ecc69ec778f8c236d382f59a85f
> | Author: John W. Linville <linville@tuxdriver.com>
> | Date:   Fri Oct 31 14:13:12 2008 -0400
> | 
> |     netdevice zd1201: Convert directly reference of netdev->priv to netdev_priv()
> | 
> |     We have some reasons to kill netdev->priv:
> |     1. netdev->priv is equal to netdev_priv().
> |     2. netdev_priv() wraps the calculation of netdev->priv's offset, obviously
> |        netdev_priv() is more flexible than netdev->priv.
> |     But we cann't kill netdev->priv, because so many drivers reference to it
> |     directly.
> | 
> |     OK, becasue Dave S. Miller said, "every direct netdev->priv usage is a bug",
> |     and I want to kill netdev->priv later, I decided to convert all the direct
> |     reference of netdev->priv first.
> | 
> |     (Original patch posted by Wang Chen <wangchen@cn.fujitsu.com> w/ above
> |     changelog but using dev->ml_priv.  That doesn't seem appropriate
> |     to me for this driver, so I've revamped it to use netdev_priv()
> |     instead. -- JWL)
> 
> This commit changed the allocation of netdev, but didn't change
> the free method of it.
> This causes "zd" be used after the memory, which is pointed by "zd", being
> freed by free_netdev().

Oops...thanks!

John
-- 
John W. Linville		Linux should be at the core
linville@tuxdriver.com			of your literate lifestyle.