From: Andrew Morton <andrewm@uow.edu.au>
To: Seth Andrew Hallem <shallem@Stanford.EDU>
Cc: linux-kernel@vger.kernel.org
Subject: Re: Potential free/use-after-free bugs
Date: Sat, 17 Mar 2001 22:31:04 +1100 [thread overview]
Message-ID: <3AB34AF8.B09D69CA@uow.edu.au> (raw)
In-Reply-To: <20010316221730.B17586@elaine23.stanford.edu>
Seth Andrew Hallem wrote:
>
> I also have some questions regarding skbs. Our checker
> found a lot of instances where the skb is freed, then its length field is
> accessed. I have included an example location below. Is this a bug or
> not?
Yes, we should regard it as a bug.
A dev_kfree_skb_irq(skb) followed by a reference to *skb
is in fact safe, because the skb isn't freed until after the
interrupt function returns. But it's cruddy code and should be
changed.
Arnaldo recently went through a whole bunch of drivers fixing
a similar problem:
netif_rx(skb);
diddle_with(skb);
This is poor form because netif_rx() "gives away"
the skb and it's no longer yours to diddle with. In theory,
netif_rx() could have kfree'ed it on the spot.
With regard to the "16 potential locking bugs" email: nice
one. They all appear to be complete box-busting shockers.
If there was anyone around to send patches to, I'd fix em :)
But I'll hang on to that email and make sure everything is ticked
off next month. So: ack and thanks.
-
next prev parent reply other threads:[~2001-03-17 11:30 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2001-03-17 6:17 Potential free/use-after-free bugs Seth Andrew Hallem
2001-03-17 11:31 ` Andrew Morton [this message]
2001-03-17 21:47 ` Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3AB34AF8.B09D69CA@uow.edu.au \
--to=andrewm@uow.edu.au \
--cc=linux-kernel@vger.kernel.org \
--cc=shallem@Stanford.EDU \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox