net: ipconfig: fix use after free
ic_close_devs() calls kfree() for all devices's ic_device. Since commit2647cffb2b
("net: ipconfig: Support using "delayed" DHCP replies") the active device's ic_device is still used however to print the ipconfig summary which results in an oops if the memory is already changed. So delay freeing until after the autoconfig results are reported. Fixes:2647cffb2b
("net: ipconfig: Support using "delayed" DHCP replies") Reported-by: Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Tested-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
0184165b2f
commit
9c706a49d6
|
@ -1492,14 +1492,6 @@ static int __init ip_auto_config(void)
|
|||
if (ic_defaults() < 0)
|
||||
return -1;
|
||||
|
||||
/*
|
||||
* Close all network devices except the device we've
|
||||
* autoconfigured and set up routes.
|
||||
*/
|
||||
ic_close_devs();
|
||||
if (ic_setup_if() < 0 || ic_setup_routes() < 0)
|
||||
return -1;
|
||||
|
||||
/*
|
||||
* Record which protocol was actually used.
|
||||
*/
|
||||
|
@ -1534,6 +1526,15 @@ static int __init ip_auto_config(void)
|
|||
pr_cont("\n");
|
||||
#endif /* !SILENT */
|
||||
|
||||
/*
|
||||
* Close all network devices except the device we've
|
||||
* autoconfigured and set up routes.
|
||||
*/
|
||||
ic_close_devs();
|
||||
if (ic_setup_if() < 0 || ic_setup_routes() < 0)
|
||||
return -1;
|
||||
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in a new issue