netdev - Re: [PATCH -next] netdevice zd1201: Use after free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20081218135813.GA4121@tuxdriver.com>
Date:	Thu, 18 Dec 2008 08:58:13 -0500
From:	"John W. Linville" <linville@...driver.com>
To:	Wang Chen <wangchen@...fujitsu.com>
Cc:	linux-wireless@...r.kernel.org,
	"David S. Miller" <davem@...emloft.net>,
	Jeff Garzik <jgarzik@...ox.com>,
	NETDEV <netdev@...r.kernel.org>
Subject: Re: [PATCH -next] netdevice zd1201: Use after free

On Thu, Dec 18, 2008 at 02:53:31PM +0800, Wang Chen wrote:
> | commit 3d29b0c33d431ecc69ec778f8c236d382f59a85f
> | Author: John W. Linville <linville@...driver.com>
> | Date:   Fri Oct 31 14:13:12 2008 -0400
> | 
> |     netdevice zd1201: Convert directly reference of netdev->priv to netdev_priv()
> | 
> |     We have some reasons to kill netdev->priv:
> |     1. netdev->priv is equal to netdev_priv().
> |     2. netdev_priv() wraps the calculation of netdev->priv's offset, obviously
> |        netdev_priv() is more flexible than netdev->priv.
> |     But we cann't kill netdev->priv, because so many drivers reference to it
> |     directly.
> | 
> |     OK, becasue Dave S. Miller said, "every direct netdev->priv usage is a bug",
> |     and I want to kill netdev->priv later, I decided to convert all the direct
> |     reference of netdev->priv first.
> | 
> |     (Original patch posted by Wang Chen <wangchen@...fujitsu.com> w/ above
> |     changelog but using dev->ml_priv.  That doesn't seem appropriate
> |     to me for this driver, so I've revamped it to use netdev_priv()
> |     instead. -- JWL)
> 
> This commit changed the allocation of netdev, but didn't change
> the free method of it.
> This causes "zd" be used after the memory, which is pointed by "zd", being
> freed by free_netdev().

Oops...thanks!

John
-- 
John W. Linville		Linux should be at the core
linville@...driver.com			of your literate lifestyle.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html