diff options
| author |   Jay Vosburgh <fubar@us.ibm.com> | 2007-06-19 11:12:12 -0700 |
|---|---|---|
| committer |   Jeff Garzik <jeff@garzik.org> | 2007-06-20 19:12:41 -0400 |
| commit | 3201e656ce56ed02e9501906c18ffe16ae350a52 (patch) | |
| tree | 8dbe0df57ffb7afd7fe1aac65fcd0ae0600870f0 /drivers/net/bonding | |
| parent | spidernet: checksum and ethtool (diff) | |
| download | linux-dev-3201e656ce56ed02e9501906c18ffe16ae350a52.tar.xz linux-dev-3201e656ce56ed02e9501906c18ffe16ae350a52.zip | |
bonding: Fix use after free in unregister path
The following patch (based on a patch from Stephen Hemminger
<shemminger@linux-foundation.org>) removes use after free conditions in
the unregister path for the bonding master. Without this patch, an
operation of the form "echo -bond0 > /sys/class/net/bonding_masters"
would trigger a NULL pointer dereference in sysfs. I was not able to
induce the failure with the non-sysfs code path, but for consistency I
updated that code as well.
I also did some testing of the bonding /proc file being open
while the bond is being deleted, and didn't see any problems there.
Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
Diffstat (limited to 'drivers/net/bonding')
| -rw-r--r-- | drivers/net/bonding/bond_main.c | 2 | ||||
| -rw-r--r-- | drivers/net/bonding/bond_sysfs.c | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c index 223517dcbcfd..6287ffbda7f7 100644 --- a/drivers/net/bonding/bond_main.c +++ b/drivers/net/bonding/bond_main.c @@ -4345,8 +4345,8 @@ static void bond_free_all(void) bond_mc_list_destroy(bond); /* Release the bonded slaves */ bond_release_all(bond_dev); - unregister_netdevice(bond_dev); bond_deinit(bond_dev); + unregister_netdevice(bond_dev); } #ifdef CONFIG_PROC_FS diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c index a122baa5c7bb..60cccf2aa959 100644 --- a/drivers/net/bonding/bond_sysfs.c +++ b/drivers/net/bonding/bond_sysfs.c @@ -164,9 +164,9 @@ static ssize_t bonding_store_bonds(struct class *cls, const char *buffer, size_t printk(KERN_INFO DRV_NAME ": %s is being deleted...\n", bond->dev->name); - unregister_netdevice(bond->dev); bond_deinit(bond->dev); bond_destroy_sysfs_entry(bond); + unregister_netdevice(bond->dev); rtnl_unlock(); goto out; } |