mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-12 21:57:43 +00:00
net: ipv4: remove erroneous advancement of list pointer
Causes crash when lifetime expires on an adress as garbage is
dereferenced soon after.
This used to look like this:
for (ifap = &ifa->ifa_dev->ifa_list;
*ifap != NULL; ifap = &(*ifap)->ifa_next) {
if (*ifap == ifa) ...
but this was changed to:
struct in_ifaddr *tmp;
ifap = &ifa->ifa_dev->ifa_list;
tmp = rtnl_dereference(*ifap);
while (tmp) {
tmp = rtnl_dereference(tmp->ifa_next); // Bogus
if (rtnl_dereference(*ifap) == ifa) {
...
ifap = &tmp->ifa_next; // Can be NULL
tmp = rtnl_dereference(*ifap); // Dereference
}
}
Remove the bogus assigment/list entry skip.
Fixes: 2638eb8b50
("net: ipv4: provide __rcu annotation for ifa_list")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
78fe8a28fb
commit
40008e9211
1 changed files with 1 additions and 2 deletions
|
@ -745,8 +745,7 @@ static void check_lifetime(struct work_struct *work)
|
||||||
ifap = &ifa->ifa_dev->ifa_list;
|
ifap = &ifa->ifa_dev->ifa_list;
|
||||||
tmp = rtnl_dereference(*ifap);
|
tmp = rtnl_dereference(*ifap);
|
||||||
while (tmp) {
|
while (tmp) {
|
||||||
tmp = rtnl_dereference(tmp->ifa_next);
|
if (tmp == ifa) {
|
||||||
if (rtnl_dereference(*ifap) == ifa) {
|
|
||||||
inet_del_ifa(ifa->ifa_dev,
|
inet_del_ifa(ifa->ifa_dev,
|
||||||
ifap, 1);
|
ifap, 1);
|
||||||
break;
|
break;
|
||||||
|
|
Loading…
Reference in a new issue