Message ID | 1275904120.2545.40.camel@edumazet-laptop |
---|---|
State | Accepted, archived |
Delegated to: | David Miller |
Headers | show |
From: Eric Dumazet <eric.dumazet@gmail.com> Date: Mon, 07 Jun 2010 11:48:40 +0200 > [PATCH net-2.6] ipmr: dont corrupt lists > > ipmr_rules_exit() and ip6mr_rules_exit() free a list of items, but > forget to properly remove these items from list. List head is not > changed and still points to freed memory. > > This can trigger a fault later when icmpv6_sk_exit() is called. > > Fix is to either reinit list, or use list_del() to properly remove items > from list before freeing them. > > bugzilla report : https://bugzilla.kernel.org/show_bug.cgi?id=16120 > > Introduced by commit d1db275dd3f6e4 (ipv6: ip6mr: support multiple > tables) and commit f0ad0860d01e (ipv4: ipmr: support multiple tables) > > Reported-by: Alex Zhavnerchik <alex.vizor@gmail.com> > Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> > CC: Patrick McHardy <kaber@trash.net> Applied, thanks a lot Eric. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c index 856123f..757f25e 100644 --- a/net/ipv4/ipmr.c +++ b/net/ipv4/ipmr.c @@ -267,8 +267,10 @@ static void __net_exit ipmr_rules_exit(struct net *net) { struct mr_table *mrt, *next; - list_for_each_entry_safe(mrt, next, &net->ipv4.mr_tables, list) + list_for_each_entry_safe(mrt, next, &net->ipv4.mr_tables, list) { + list_del(&mrt->list); kfree(mrt); + } fib_rules_unregister(net->ipv4.mr_rules_ops); } #else diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c index 89c0b07..66078da 100644 --- a/net/ipv6/ip6mr.c +++ b/net/ipv6/ip6mr.c @@ -254,8 +254,10 @@ static void __net_exit ip6mr_rules_exit(struct net *net) { struct mr6_table *mrt, *next; - list_for_each_entry_safe(mrt, next, &net->ipv6.mr6_tables, list) + list_for_each_entry_safe(mrt, next, &net->ipv6.mr6_tables, list) { + list_del(&mrt->list); ip6mr_free_table(mrt); + } fib_rules_unregister(net->ipv6.mr6_rules_ops); } #else