mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-27 12:57:53 +00:00
inet: frags: call inet_frags_fini() after unregister_pernet_subsys()
[ Upstream commitae7352d384
] Both IPv6 and 6lowpan are calling inet_frags_fini() too soon. inet_frags_fini() is dismantling a kmem_cache, that might be needed later when unregister_pernet_subsys() eventually has to remove frags queues from hash tables and free them. This fixes potential use-after-free, and is a prereq for the following patch. Fixes:d4ad4d22e7
("inet: frags: use kmem_cache for inet_frag_queue") Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
e038a1b626
commit
8ae8a9f21e
2 changed files with 2 additions and 2 deletions
|
@ -633,7 +633,7 @@ int __init lowpan_net_frag_init(void)
|
|||
|
||||
void lowpan_net_frag_exit(void)
|
||||
{
|
||||
inet_frags_fini(&lowpan_frags);
|
||||
lowpan_frags_sysctl_unregister();
|
||||
unregister_pernet_subsys(&lowpan_frags_ops);
|
||||
inet_frags_fini(&lowpan_frags);
|
||||
}
|
||||
|
|
|
@ -592,8 +592,8 @@ int __init ipv6_frag_init(void)
|
|||
|
||||
void ipv6_frag_exit(void)
|
||||
{
|
||||
inet_frags_fini(&ip6_frags);
|
||||
ip6_frags_sysctl_unregister();
|
||||
unregister_pernet_subsys(&ip6_frags_ops);
|
||||
inet6_del_protocol(&frag_protocol, IPPROTO_FRAGMENT);
|
||||
inet_frags_fini(&ip6_frags);
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue