lkml.org 
[lkml]   [2020]   [Jan]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 4.14 220/371] inet: frags: call inet_frags_fini() after unregister_pernet_subsys()
    Date
    From: Eric Dumazet <edumazet@google.com>

    [ Upstream commit ae7352d384a552d8c799c242e74a934809990a71 ]

    Both IPv6 and 6lowpan are calling inet_frags_fini() too soon.

    inet_frags_fini() is dismantling a kmem_cache, that might be needed
    later when unregister_pernet_subsys() eventually has to remove
    frags queues from hash tables and free them.

    This fixes potential use-after-free, and is a prereq for the following patch.

    Fixes: d4ad4d22e7ac ("inet: frags: use kmem_cache for inet_frag_queue")
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/ieee802154/6lowpan/reassembly.c | 2 +-
    net/ipv6/reassembly.c | 2 +-
    2 files changed, 2 insertions(+), 2 deletions(-)

    diff --git a/net/ieee802154/6lowpan/reassembly.c b/net/ieee802154/6lowpan/reassembly.c
    index ec7a5da56129..e873a6a007f2 100644
    --- a/net/ieee802154/6lowpan/reassembly.c
    +++ b/net/ieee802154/6lowpan/reassembly.c
    @@ -634,7 +634,7 @@ int __init lowpan_net_frag_init(void)

    void lowpan_net_frag_exit(void)
    {
    - inet_frags_fini(&lowpan_frags);
    lowpan_frags_sysctl_unregister();
    unregister_pernet_subsys(&lowpan_frags_ops);
    + inet_frags_fini(&lowpan_frags);
    }
    diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
    index fe797b29ca89..6dea6e92e686 100644
    --- a/net/ipv6/reassembly.c
    +++ b/net/ipv6/reassembly.c
    @@ -593,8 +593,8 @@ int __init ipv6_frag_init(void)

    void ipv6_frag_exit(void)
    {
    - inet_frags_fini(&ip6_frags);
    ip6_frags_sysctl_unregister();
    unregister_pernet_subsys(&ip6_frags_ops);
    inet6_del_protocol(&frag_protocol, IPPROTO_FRAGMENT);
    + inet_frags_fini(&ip6_frags);
    }
    --
    2.20.1
    \
     
     \ /
      Last update: 2020-01-16 19:22    [W:4.187 / U:0.380 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site