* net: lapbether: fix double free
@ 2017-10-29 13:57 Pan Bian
2017-11-01 3:11 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Pan Bian @ 2017-10-29 13:57 UTC (permalink / raw)
To: David S. Miller, netdev; +Cc: linux-kernel, Pan Bian
The function netdev_priv() returns the private data of the device. The
memory to store the private data is allocated in alloc_netdev() and is
released in netdev_free(). Calling kfree() on the return value of
netdev_priv() after netdev_free() results in a double free bug.
Signed-off-by: Pan Bian <bianpan2016@163.com>
---
drivers/net/wan/lapbether.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
index 63f7490..0e3f8ed 100644
--- a/drivers/net/wan/lapbether.c
+++ b/drivers/net/wan/lapbether.c
@@ -346,7 +346,6 @@ static int lapbeth_new_device(struct net_device *dev)
fail:
dev_put(dev);
free_netdev(ndev);
- kfree(lapbeth);
goto out;
}
--
1.9.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: net: lapbether: fix double free
2017-10-29 13:57 net: lapbether: fix double free Pan Bian
@ 2017-11-01 3:11 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2017-11-01 3:11 UTC (permalink / raw)
To: bianpan2016; +Cc: netdev, linux-kernel
From: Pan Bian <bianpan2016@163.com>
Date: Sun, 29 Oct 2017 21:57:22 +0800
> The function netdev_priv() returns the private data of the device. The
> memory to store the private data is allocated in alloc_netdev() and is
> released in netdev_free(). Calling kfree() on the return value of
> netdev_priv() after netdev_free() results in a double free bug.
>
> Signed-off-by: Pan Bian <bianpan2016@163.com>
Applied.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-11-01 3:11 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-10-29 13:57 net: lapbether: fix double free Pan Bian
2017-11-01 3:11 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).