Subject: Re: [PATCH stable 3.11+] can: bcm: add skb destructor

From: Andre Naujoks <[email-masked]>
Date: Wed, 29 Jan 2014 09:47:54 +0100

On 29.01.2014 08:46, schrieb David Miller:
> From: Andre Naujoks <[email-masked]>
> Date: Wed, 29 Jan 2014 08:40:03 +0100
> 
>> Even if this is a bug in the CAN BCM implementation. Your "fix" just
>> enabled a user space application to shut down any machine with a kernel
>> containing the BUG_ON patch.
> 
> Rather, he detected a potential stray pointer reference to freed data
> that was caused by the CAN code which would difficult if not
> impossible to detect otherwise.
> 
> That's even more dangerous, and you should be thanking him.

"potential" is the keyword here. But its a definite kernel crash as it
is right now with a standard use case for the BCM.

Don't get me wrong. If there are bugs in the code, they should be fixed,
but I don't think breaking a working (even if flawed) part of the kernel
is the right thing to do here.

Regards
  Andre