linux-kernel - RE: [PATCH 088/117] Staging: hv: netvsc: Inline the code for free_net

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 16 Jul 2011 13:09:45 +0000
From:	KY Srinivasan <kys@...rosoft.com>
To:	Dan Carpenter <error27@...il.com>
CC:	"gregkh@...e.de" <gregkh@...e.de>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"devel@...uxdriverproject.org" <devel@...uxdriverproject.org>,
	"virtualization@...ts.osdl.org" <virtualization@...ts.osdl.org>,
	Haiyang Zhang <haiyangz@...rosoft.com>
Subject: RE: [PATCH 088/117] Staging: hv: netvsc: Inline the code for
 free_net_device()



> -----Original Message-----
> From: Dan Carpenter [mailto:error27@...il.com]
> Sent: Saturday, July 16, 2011 6:34 AM
> To: KY Srinivasan
> Cc: gregkh@...e.de; linux-kernel@...r.kernel.org;
> devel@...uxdriverproject.org; virtualization@...ts.osdl.org; Haiyang Zhang
> Subject: Re: [PATCH 088/117] Staging: hv: netvsc: Inline the code for
> free_net_device()
> 
> On Fri, Jul 15, 2011 at 10:47:16AM -0700, K. Y. Srinivasan wrote:
> > -static void free_net_device(struct netvsc_device *device)
> > -{
> > -	WARN_ON(atomic_read(&device->refcnt) != 0);
> > -	device->dev->ext = NULL;
> 
> device->dev->ext points to device.  We set it NULL here to prevent
> a use after free bug.  What prevents that in the new code?
> 
> > -	kfree(device);
> > -}
This function is called in only two places; a) during adding a device when we have a failure
(netvsc_device_add()) and during device removal (netvsc_device_remove()). I have handled
both these cases. In any event when we are freeing the containing object via kfree(), if somebody
is accessing the ext field via freed object, we have bigger problems to deal with.

Regards,

K. Y


> 
> regards,
> dan carpenter
> 
> 

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/