redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

bonding: Fix use after free in unregister path 

The following patch (based on a patch from Stephen Hemminger
<shemminger@linux-foundation.org>) removes use after free conditions in
the unregister path for the bonding master.  Without this patch, an
operation of the form "echo -bond0 > /sys/class/net/bonding_masters"
would trigger a NULL pointer dereference in sysfs.  I was not able to
induce the failure with the non-sysfs code path, but for consistency I
updated that code as well.

	I also did some testing of the bonding /proc file being open
while the bond is being deleted, and didn't see any problems there.

Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
hifive-unleashed-5.1
Jay Vosburgh 2007-06-19 11:12:12 -07:00 committed by Jeff Garzik
parent 3a2c892daa
commit 3201e656ce
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/net/bonding/bond_main.c
View File

@ -4345,8 +4345,8 @@ static void bond_free_all(void)
bond_mc_list_destroy(bond);
/* Release the bonded slaves */
bond_release_all(bond_dev);
unregister_netdevice(bond_dev);
bond_deinit(bond_dev);
unregister_netdevice(bond_dev);
}
#ifdef CONFIG_PROC_FS

2
drivers/net/bonding/bond_sysfs.c
View File

@ -164,9 +164,9 @@ static ssize_t bonding_store_bonds(struct class *cls, const char *buffer, size_t
printk(KERN_INFO DRV_NAME
": %s is being deleted...\n",
bond->dev->name);
unregister_netdevice(bond->dev);
bond_deinit(bond->dev);
bond_destroy_sysfs_entry(bond);
unregister_netdevice(bond->dev);
rtnl_unlock();
goto out;
}