Seth Andrew Hallem wrote:
>
> I also have some questions regarding skbs. Our checker
> found a lot of instances where the skb is freed, then its length field is
> accessed. I have included an example location below. Is this a bug or
> not?
Yes, we should regard it as a bug.
A dev_kfree_skb_irq(skb) followed by a reference to *skb
is in fact safe, because the skb isn't freed until after the
interrupt function returns. But it's cruddy code and should be
changed.
Arnaldo recently went through a whole bunch of drivers fixing
a similar problem:
netif_rx(skb);
diddle_with(skb);
This is poor form because netif_rx() "gives away"
the skb and it's no longer yours to diddle with. In theory,
netif_rx() could have kfree'ed it on the spot.
With regard to the "16 potential locking bugs" email: nice
one. They all appear to be complete box-busting shockers.
If there was anyone around to send patches to, I'd fix em :)
But I'll hang on to that email and make sure everything is ticked
off next month. So: ack and thanks.
-
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
This archive was generated by hypermail 2b29 : Fri Mar 23 2001 - 21:00:10 EST