Re: Potential free/use-after-free bugs

[Andrew Morton]

Seth Andrew Hallem wrote:
> 
> I also have some questions regarding skbs.  Our checker
> found a lot of instances where the skb is freed, then its length field is
> accessed.  I have included an example location below.  Is this a bug or
> not?

Yes, we should regard it as a bug.

A dev_kfree_skb_irq(skb) followed by a reference to *skb
is in fact safe, because the skb isn't freed until after the
interrupt function returns.  But it's cruddy code and should be
changed.

Arnaldo recently went through a whole bunch of drivers fixing
a similar problem:

	netif_rx(skb);
	diddle_with(skb);

This is poor form because netif_rx() "gives away"
the skb and it's no longer yours to diddle with.  In theory,
netif_rx() could have kfree'ed it on the spot.

With regard to the "16 potential locking bugs" email: nice
one.  They all appear to be complete box-busting shockers.

If there was anyone around to send patches to, I'd fix em :)
But I'll hang on to that email and make sure everything is ticked
off next month.  So: ack and thanks.

-