Patchwork the macvlan device causes SLAB corruption on network namespace exit.

login
register
mail settings
Submitter Anders Franzen
Date Nov. 24, 2010, 3:35 p.m.
Message ID <1290612941-8417-1-git-send-email-anders.franzen@ericsson.com>
Download mbox | patch
Permalink /patch/72904/
State Rejected
Delegated to: David Miller
Headers show

Comments

Anders Franzen - Nov. 24, 2010, 3:35 p.m.
When doing exit from a network namespace, cleanup functions are executed from
the function default_device_exit_batch.
In the macvlan device, this will generate a call to macvlan_dellink.
If it is the last macvlan using a ''lowerdev'' the port is
destroyed.

Later the a call to macvlan_stop is executed. when the macvlan_hash_del(vlan) is
executed, the memory of the already freed port will be corrupted.

Signed-off-by: Anders Franzen <anders.franzen@ericsson.com>
---
 drivers/net/macvlan.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

Patch

diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 6ed577b..c1cddb6 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -338,7 +338,9 @@  static int macvlan_stop(struct net_device *dev)
 	dev_uc_del(lowerdev, dev->dev_addr);
 
 hash_del:
-	macvlan_hash_del(vlan);
+	if (macvlan_port_exists(lowerdev))
+		macvlan_hash_del(vlan);
+
 	return 0;
 }