lkml.org 
[lkml]   [2011]   [Feb]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Subject[PATCH 2/2] net: deinit automatic LIST_HEAD
    From
    Date
    commit 9b5e383c11b08784 (net: Introduce
    unregister_netdevice_many()) left an active LIST_HEAD() in
    rollback_registered(), with possible memory corruption.

    Even if device is freed without touching its unreg_list (and therefore
    touching the previous memory location holding LISTE_HEAD(single), better
    close the bug for good, since its really subtle.

    (Same fix for default_device_exit_batch() for completeness)

    Reported-by: Michal Hocko <mhocko@suse.cz>
    Reported-by: Eric W. Biderman <ebiderman@xmission.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
    CC: Ingo Molnar <mingo@elte.hu>
    CC: Octavian Purdila <opurdila@ixiacom.com>
    CC: Eric W. Biderman <ebiderman@xmission.com>
    CC: stable <stable@kernel.org> [.33+]
    ---
    net/core/dev.c | 2 ++
    1 file changed, 2 insertions(+)

    diff --git a/net/core/dev.c b/net/core/dev.c
    index a18c164..8ae6631 100644
    --- a/net/core/dev.c
    +++ b/net/core/dev.c
    @@ -5066,6 +5066,7 @@ static void rollback_registered(struct net_device *dev)

    list_add(&dev->unreg_list, &single);
    rollback_registered_many(&single);
    + list_del(&single);
    }

    unsigned long netdev_fix_features(unsigned long features, const char *name)
    @@ -6219,6 +6220,7 @@ static void __net_exit default_device_exit_batch(struct list_head *net_list)
    }
    }
    unregister_netdevice_many(&dev_kill_list);
    + list_del(&dev_kill_list);
    rtnl_unlock();
    }




    \
     
     \ /
      Last update: 2011-02-18 10:01    [W:0.020 / U:0.244 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site