From patchwork Fri Feb 18 08:59:19 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Dumazet X-Patchwork-Id: 83547 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 8C6E4B70B8 for ; Fri, 18 Feb 2011 19:59:30 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756142Ab1BRI7Z (ORCPT ); Fri, 18 Feb 2011 03:59:25 -0500 Received: from mail-fx0-f46.google.com ([209.85.161.46]:43998 "EHLO mail-fx0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753474Ab1BRI7Y (ORCPT ); Fri, 18 Feb 2011 03:59:24 -0500 Received: by fxm20 with SMTP id 20so3542251fxm.19 for ; Fri, 18 Feb 2011 00:59:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:subject:from:to:cc:in-reply-to:references :content-type:date:message-id:mime-version:x-mailer :content-transfer-encoding; bh=QitimF0Zg2OXBXH4BVsV3/7npEVKpikU/7DucdAEH3Q=; b=RVQ5U0er0ealSoCA+CIIbTgMZrPvok9JBKn3QAeoXX0Vy26T8eOAyDWg8GRbksz5Qw FVYK8h65PZGR3JAzimhRCA1CGbCczCusuwdLBhywINLdM4L6feTMjgkwYdOgevQ3SU0q 3n6+wobVK4+PK2Zhcxf3j/s6AnmXwvQbAfBqw= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=subject:from:to:cc:in-reply-to:references:content-type:date :message-id:mime-version:x-mailer:content-transfer-encoding; b=tYrb1fTEe2WCyOGJ92TfVXBf9MGEpwYMBKwKzcFHpsE+4cOJ1w8ST7bANr62yO/cK9 QN8jYQVW2N2ZWRifoEJlO5i/5rxO9JCvRJT593C/GtGB/xjYtWpfLueXHXX8iaCHJNBm Ayyy/dmICcL8y3EcFSgUAAK5YtlBWMZSeRS+g= Received: by 10.223.69.141 with SMTP id z13mr591511fai.9.1298019563137; Fri, 18 Feb 2011 00:59:23 -0800 (PST) Received: from [10.150.51.212] (gw0.net.jmsp.net [212.23.165.14]) by mx.google.com with ESMTPS id n3sm920082faa.5.2011.02.18.00.59.21 (version=SSLv3 cipher=OTHER); Fri, 18 Feb 2011 00:59:22 -0800 (PST) Subject: [PATCH 2/2] net: deinit automatic LIST_HEAD From: Eric Dumazet To: David Miller Cc: torvalds@linux-foundation.org, ebiederm@xmission.com, mingo@elte.hu, opurdila@ixiacom.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, mhocko@suse.cz, netdev , stable@kernel.org In-Reply-To: References: <20110216185234.GA11636@tiehlicka.suse.cz> <20110216193700.GA6377@elte.hu> <20110217090910.GA3781@tiehlicka.suse.cz> <20110217163531.GF14168@elte.hu> Date: Fri, 18 Feb 2011 09:59:19 +0100 Message-ID: <1298019559.2595.92.camel@edumazet-laptop> Mime-Version: 1.0 X-Mailer: Evolution 2.30.3 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org commit 9b5e383c11b08784 (net: Introduce unregister_netdevice_many()) left an active LIST_HEAD() in rollback_registered(), with possible memory corruption. Even if device is freed without touching its unreg_list (and therefore touching the previous memory location holding LISTE_HEAD(single), better close the bug for good, since its really subtle. (Same fix for default_device_exit_batch() for completeness) Reported-by: Michal Hocko Reported-by: Eric W. Biderman Signed-off-by: Linus Torvalds Signed-off-by: Eric Dumazet CC: Ingo Molnar CC: Octavian Purdila CC: Eric W. Biderman CC: stable [.33+] --- net/core/dev.c | 2 ++ 1 file changed, 2 insertions(+) -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/net/core/dev.c b/net/core/dev.c index a18c164..8ae6631 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -5066,6 +5066,7 @@ static void rollback_registered(struct net_device *dev) list_add(&dev->unreg_list, &single); rollback_registered_many(&single); + list_del(&single); } unsigned long netdev_fix_features(unsigned long features, const char *name) @@ -6219,6 +6220,7 @@ static void __net_exit default_device_exit_batch(struct list_head *net_list) } } unregister_netdevice_many(&dev_kill_list); + list_del(&dev_kill_list); rtnl_unlock(); }