[PATCH 088/117] Staging: hv: netvsc: Inline the code for free_net_device()

KY Srinivasan
Sat, 16 Jul 2011 13:09:45 -0000

> -----Original Message-----
> From: Dan Carpenter [mailto:error27 at gmail.com]
> Sent: Saturday, July 16, 2011 6:34 AM
> To: KY Srinivasan
> Cc: gregkh at suse.de; linux-kernel at vger.kernel.org;
> devel at linuxdriverproject.org; virtualization at lists.osdl.org; Haiyang
Zhang
> Subject: Re: [PATCH 088/117] Staging: hv: netvsc: Inline the code for
> free_net_device()
>
> On Fri, Jul 15, 2011 at 10:47:16AM -0700, K. Y. Srinivasan wrote:
> > -static void free_net_device(struct netvsc_device *device)
> > -{
> > -	WARN_ON(atomic_read(&device->refcnt) != 0);
> > -	device->dev->ext = NULL;
>
> device->dev->ext points to device.  We set it NULL here to prevent
> a use after free bug.  What prevents that in the new code?
>
> > -	kfree(device);
> > -}
This function is called in only two places; a) during adding a device when we
have a failure
(netvsc_device_add()) and during device removal (netvsc_device_remove()). I have
handled
both these cases. In any event when we are freeing the containing object via
kfree(), if somebody
is accessing the ext field via freed object, we have bigger problems to deal
with.

Regards,

K. Y


>
> regards,
> dan carpenter
>
>