From patchwork Wed Nov 24 15:35:41 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Anders Franzen X-Patchwork-Id: 72904 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 33C73B6F14 for ; Thu, 25 Nov 2010 02:35:22 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751563Ab0KXPfQ (ORCPT ); Wed, 24 Nov 2010 10:35:16 -0500 Received: from mailgw10.se.ericsson.net ([193.180.251.61]:60562 "EHLO mailgw10.se.ericsson.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751443Ab0KXPfP (ORCPT ); Wed, 24 Nov 2010 10:35:15 -0500 X-AuditID: c1b4fb3d-b7b8cae0000016b1-9f-4ced30b1ebb8 Received: from esessmw0191.eemea.ericsson.se (Unknown_Domain [153.88.253.125]) by mailgw10.se.ericsson.net (Symantec Mail Security) with SMTP id F2.DC.05809.1B03DEC4; Wed, 24 Nov 2010 16:35:13 +0100 (CET) Received: from seasc7941.dyn.rnd.as.sw.ericsson.se (153.88.115.8) by esessmw0191.eemea.ericsson.se (153.88.115.85) with Microsoft SMTP Server id 8.2.234.1; Wed, 24 Nov 2010 16:35:12 +0100 From: Anders Franzen To: CC: , , , Anders Franzen Subject: [PATCH] the macvlan device causes SLAB corruption on network namespace exit. Date: Wed, 24 Nov 2010 16:35:41 +0100 Message-ID: <1290612941-8417-1-git-send-email-anders.franzen@ericsson.com> X-Mailer: git-send-email 1.7.2.3 MIME-Version: 1.0 X-Brightmail-Tracker: AAAAAA== Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org When doing exit from a network namespace, cleanup functions are executed from the function default_device_exit_batch. In the macvlan device, this will generate a call to macvlan_dellink. If it is the last macvlan using a ''lowerdev'' the port is destroyed. Later the a call to macvlan_stop is executed. when the macvlan_hash_del(vlan) is executed, the memory of the already freed port will be corrupted. Signed-off-by: Anders Franzen --- drivers/net/macvlan.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c index 6ed577b..c1cddb6 100644 --- a/drivers/net/macvlan.c +++ b/drivers/net/macvlan.c @@ -338,7 +338,9 @@ static int macvlan_stop(struct net_device *dev) dev_uc_del(lowerdev, dev->dev_addr); hash_del: - macvlan_hash_del(vlan); + if (macvlan_port_exists(lowerdev)) + macvlan_hash_del(vlan); + return 0; }