lkml.org 
[lkml]   [2011]   [Apr]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[PATCH 061/173] x25: Do not reference freed memory.
    2.6.27.59-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: David S. Miller <davem@davemloft.net>

    commit 96642d42f076101ba98866363d908cab706d156c upstream.

    In x25_link_free(), we destroy 'nb' before dereferencing
    'nb->dev'. Don't do this, because 'nb' might be freed
    by then.

    Reported-by: Randy Dunlap <randy.dunlap@oracle.com>
    Tested-by: Randy Dunlap <randy.dunlap@oracle.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    net/x25/x25_link.c | 5 ++++-
    1 file changed, 4 insertions(+), 1 deletion(-)

    --- a/net/x25/x25_link.c
    +++ b/net/x25/x25_link.c
    @@ -391,9 +391,12 @@ void __exit x25_link_free(void)
    write_lock_bh(&x25_neigh_list_lock);

    list_for_each_safe(entry, tmp, &x25_neigh_list) {
    + struct net_device *dev;
    +
    nb = list_entry(entry, struct x25_neigh, node);
    + dev = nb->dev;
    __x25_remove_neigh(nb);
    - dev_put(nb->dev);
    + dev_put(dev);
    }
    write_unlock_bh(&x25_neigh_list_lock);
    }



    \
     
     \ /
      Last update: 2011-04-25 22:35    [W:0.023 / U:0.060 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site