lkml.org 
[lkml]   [2001]   [Jul]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] ppp_generic.c - kfree(ppp) called twice, kernel 2.4.0
Date
Hi,

In ppp_destroy_interface(), there is a chance that kfree(ppp) is called
twice, causing a kernel oops when ppp is opened again. I was able to cause
this by running PPPOE, and killing -9 pppd and pppoe-daemon with one kill
command. By doing this, the closing of ppp->dev causes a
ppp_disconnect_channel(), which calls kfree(ppp) assuming the ppp unit is
dead. But destroy_interface() hasn't finished, and it tries to kfree(ppp)
also. I simply moved the closing of the device to after the channels == 0
check. Anyways, follows is the patch. Please cc comments to
eli@routefree.com.

thanks,
Eli Chen


--- ppp_generic.c 2001/02/21 00:53:01 1.1.1.2
+++ ppp_generic.c 2001/07/03 20:37:22
@@ -2268,13 +2268,6 @@
ppp->dev = 0;
ppp_unlock(ppp);

- if (dev) {
- rtnl_lock();
- dev_close(dev);
- unregister_netdevice(dev);
- rtnl_unlock();
- }
-
/*
* We can't acquire any new channels (since we have the
* all_ppp_lock) so if n_channels is 0, we can free the
@@ -2283,6 +2276,13 @@
*/
if (ppp->n_channels == 0)
kfree(ppp);
+
+ if (dev) {
+ rtnl_lock();
+ dev_close(dev);
+ unregister_netdevice(dev);
+ rtnl_unlock();
+ }

spin_unlock(&all_ppp_lock);
}

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 12:56    [W:0.039 / U:0.140 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site