mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-23 17:30:02 +00:00
bonding: Fix use after free in unregister path
The following patch (based on a patch from Stephen Hemminger <shemminger@linux-foundation.org>) removes use after free conditions in the unregister path for the bonding master. Without this patch, an operation of the form "echo -bond0 > /sys/class/net/bonding_masters" would trigger a NULL pointer dereference in sysfs. I was not able to induce the failure with the non-sysfs code path, but for consistency I updated that code as well. I also did some testing of the bonding /proc file being open while the bond is being deleted, and didn't see any problems there. Signed-off-by: Jay Vosburgh <fubar@us.ibm.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
This commit is contained in:
parent
3a2c892daa
commit
3201e656ce
2 changed files with 2 additions and 2 deletions
|
@ -4345,8 +4345,8 @@ static void bond_free_all(void)
|
|||
bond_mc_list_destroy(bond);
|
||||
/* Release the bonded slaves */
|
||||
bond_release_all(bond_dev);
|
||||
unregister_netdevice(bond_dev);
|
||||
bond_deinit(bond_dev);
|
||||
unregister_netdevice(bond_dev);
|
||||
}
|
||||
|
||||
#ifdef CONFIG_PROC_FS
|
||||
|
|
|
@ -164,9 +164,9 @@ static ssize_t bonding_store_bonds(struct class *cls, const char *buffer, size_t
|
|||
printk(KERN_INFO DRV_NAME
|
||||
": %s is being deleted...\n",
|
||||
bond->dev->name);
|
||||
unregister_netdevice(bond->dev);
|
||||
bond_deinit(bond->dev);
|
||||
bond_destroy_sysfs_entry(bond);
|
||||
unregister_netdevice(bond->dev);
|
||||
rtnl_unlock();
|
||||
goto out;
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue