ppp: fix segfaults introduced by netdev_priv changes
authorJames Chapman <jchapman@katalix.com>
Wed, 17 Dec 2008 12:02:16 +0000 (12:02 +0000)
committerDavid S. Miller <davem@davemloft.net>
Fri, 19 Dec 2008 03:41:42 +0000 (19:41 -0800)
commit739840d529eb7505d3cbfe9d468bf1440c9a8e27
tree432ffe292f8886a63f1328e6e2466c01dbe452d5
parent1b08534e562dae7b084326f8aa8cc12a4c1b6593
ppp: fix segfaults introduced by netdev_priv changes

This patch fixes a segfault in ppp_shutdown_interface() and
ppp_destroy_interface() when a PPP connection is closed. I bisected
the problem to the following commit:

  commit c8019bf3aff653cceb64f66489fc299ee5957b57
  Author: Wang Chen <wangchen@cn.fujitsu.com>
  Date:   Thu Nov 20 04:24:17 2008 -0800

    netdevice ppp: Convert directly reference of netdev->priv

    1. Use netdev_priv(dev) to replace dev->priv.
    2. Alloc netdev's private data by alloc_netdev().

Signed-off-by: Wang Chen <wangchen@cn.fujitsu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

The original ppp_generic code treated the netdev and struct ppp as
independent data structures which were freed separately. In moving the
ppp struct into the netdev, it is now possible for the private data to
be freed before the call to ppp_shutdown_interface(), which is bad.

The kfree(ppp) in ppp_destroy_interface() is also wrong; presumably
ppp hasn't worked since the above commit.

The following patch fixes both problems.

Signed-off-by: James Chapman <jchapman@katalix.com>
Reviewed-by: Wang Chen <wangchen@cn.fujitsu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/net/ppp_generic.c