kernel-ark/drivers/net/wireless
Wang Chen b88a2a22c6 netdevice zd1201: Use after free
| commit 3d29b0c33d
| Author: John W. Linville <linville@tuxdriver.com>
| Date:   Fri Oct 31 14:13:12 2008 -0400
|
|     netdevice zd1201: Convert directly reference of netdev->priv to netdev_priv()
|
|     We have some reasons to kill netdev->priv:
|     1. netdev->priv is equal to netdev_priv().
|     2. netdev_priv() wraps the calculation of netdev->priv's offset, obviously
|        netdev_priv() is more flexible than netdev->priv.
|     But we cann't kill netdev->priv, because so many drivers reference to it
|     directly.
|
|     OK, becasue Dave S. Miller said, "every direct netdev->priv usage is a bug",
|     and I want to kill netdev->priv later, I decided to convert all the direct
|     reference of netdev->priv first.
|
|     (Original patch posted by Wang Chen <wangchen@cn.fujitsu.com> w/ above
|     changelog but using dev->ml_priv.  That doesn't seem appropriate
|     to me for this driver, so I've revamped it to use netdev_priv()
|     instead. -- JWL)

This commit changed the allocation of netdev, but didn't change
the free method of it.
This causes "zd" be used after the memory, which is pointed by "zd", being
freed by free_netdev().

Signed-off-by: Wang Chen <wangchen@cn.fujitsu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-12-18 22:27:38 -08:00
..
ath5k ath5k: fix endianness of bitwise ops when installing mic 2008-12-12 14:02:04 -05:00
ath9k ath9k: Do not remove header padding on RX from short frames 2008-12-12 14:45:31 -05:00
b43 b43: remove rate index warning 2008-11-21 11:06:07 -05:00
b43legacy b43legacy: Fix sparse warnings 2008-12-12 14:02:08 -05:00
hostap hostap: select required crypto bits in Kconfig 2008-12-05 09:32:10 -05:00
ipw2x00 ipw2200: fix scanning while associated 2008-12-12 14:02:10 -05:00
iwlwifi iwlwifi: add contact email to MODULE_AUTHOR 2008-12-12 14:45:43 -05:00
libertas libertas: Create sysfs entry for changing the mesh probe response limit 2008-12-12 14:45:13 -05:00
libertas_tf libertas_tf: fix skb tail pointer 2008-11-18 17:26:26 -05:00
orinoco spectrum_cs: Fix function names used in debug strings 2008-12-12 14:02:02 -05:00
p54 p54: fix oops on faulty devices 2008-12-12 14:02:15 -05:00
prism54
rt2x00 rt2x00: Correctly initialize AID during set_key() 2008-12-05 09:35:57 -05:00
rtl818x rtl8187: Use usb anchor facilities to manage urbs 2008-12-12 14:02:06 -05:00
zd1211rw Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2008-12-05 22:54:40 -08:00
adm8211.c
adm8211.h
airo_cs.c
airo.c
airo.h
arlan-main.c
arlan-proc.c
arlan.h
atmel_cs.c
atmel_pci.c
atmel.c
atmel.h
i82586.h
i82593.h
Kconfig orinoco: Provide option to avoid unnecessary fw caching 2008-11-26 09:47:47 -05:00
mac80211_hwsim.c mac80211: integrate sta_notify_ps cmds into sta_notify 2008-12-12 14:01:42 -05:00
Makefile ipw2x00: relocate ipw2100/ipw2200 to common directory 2008-11-21 11:08:17 -05:00
netwave_cs.c
ray_cs.c
ray_cs.h
rayctl.h
rndis_wlan.c netdevice: safe convert to netdev_priv() #part-4 2008-11-12 23:39:10 -08:00
strip.c netdevice: Kill netdev->priv 2008-12-08 01:14:16 -08:00
wavelan_cs.c
wavelan_cs.h
wavelan_cs.p.h
wavelan.c netdevice: safe convert to netdev_priv() #part-4 2008-11-12 23:39:10 -08:00
wavelan.h
wavelan.p.h
wl3501_cs.c
wl3501.h
zd1201.c netdevice zd1201: Use after free 2008-12-18 22:27:38 -08:00
zd1201.h