From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751485AbdCCAtl (ORCPT ); Thu, 2 Mar 2017 19:49:41 -0500 Received: from shards.monkeyblade.net ([184.105.139.130]:40536 "EHLO shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751083AbdCCAti (ORCPT ); Thu, 2 Mar 2017 19:49:38 -0500 Date: Thu, 02 Mar 2017 14:43:43 -0800 (PST) Message-Id: <20170302.144343.1942167578659107503.davem@davemloft.net> To: decui@microsoft.com Cc: netdev@vger.kernel.org, sthemmin@microsoft.com, kys@microsoft.com, haiyangz@microsoft.com, linux-kernel@vger.kernel.org, driverdev-devel@linuxdriverproject.org Subject: Re: [PATCH] netvsc: fix use-after-free in netvsc_change_mtu() From: David Miller In-Reply-To: References: X-Mailer: Mew version 6.7 on Emacs 25.1 / Mule 6.0 (HANACHIRUSATO) Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.5.12 (shards.monkeyblade.net [149.20.54.216]); Thu, 02 Mar 2017 14:43:43 -0800 (PST) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Dexuan Cui Date: Thu, 2 Mar 2017 13:00:53 +0000 > 'nvdev' is freed in rndis_filter_device_remove -> netvsc_device_remove -> > free_netvsc_device, so we mustn't access it, before it's re-created in > rndis_filter_device_add -> netvsc_device_add. > > Signed-off-by: Dexuan Cui Applied.