Re: use-after-free in usbnet
From: Huajun Li <hidden>
Date: 2012-04-21 08:23:56
On Sat, Apr 21, 2012 at 3:56 PM, Ming Lei [off-list ref] wrote:
Hi Huajun, On Sat, Apr 21, 2012 at 3:50 PM, Huajun Li [off-list ref] wrote:quoted
Did we on the same page, could you please review my patch again? My draft patch was based on current mainline( 3.4.0-rc3) which had already integrated your previous patch. And in my patch, it replaced skb_queue_walk_safe() with skb_queue_walk(), so you will not see 'tmp = skb->next' any more.Replace skb_queue_walk_safe with skb_queue_walk doesn't improve the problem, since 'skb = skb->next' in skb_queue_walk still may trigger the oops, does it?
No. In each loop, my patch traverse the queue from its head, and it always holds q->lock when it need refer "skb->next", this can make sure the right skb is not moved out of rxq/txq. Can this fix what you concern? If so, IMO, there is no need to revert your previous patch. -- To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org More majordomo info at http://vger.kernel.org/majordomo-info.html