Message ID | 4B02B616.3020801@gmail.com |
---|---|
State | Accepted, archived |
Delegated to: | David Miller |
Headers | show |
From: Eric Dumazet <eric.dumazet@gmail.com> Date: Tue, 17 Nov 2009 15:41:26 +0100 > David Miller a écrit : > >> Eric, please make allocation failure cause the vlan_setup() >> to fail and propagate -EFAULT back to the caller. > > Sure ! (You meant -ENOMEM probably...) Indeed. > [PATCH] vlan: Fix register_vlan_dev() error path > > In case register_netdevice() returns an error, and a new vlan_group was > allocated and inserted in vlan_group_hash[] we call vlan_group_free() without > deleting group from hash table. Future lookups can give infinite loops or crashes. > > We must delete the vlan_group using RCU safe procedure. > > Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Good catch, applied to net-2.6 and queued up for -stable. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c index 8836575..a29c5ab 100644 --- a/net/8021q/vlan.c +++ b/net/8021q/vlan.c @@ -281,8 +281,11 @@ out_uninit_applicant: if (ngrp) vlan_gvrp_uninit_applicant(real_dev); out_free_group: - if (ngrp) - vlan_group_free(ngrp); + if (ngrp) { + hlist_del_rcu(&ngrp->hlist); + /* Free the group, after all cpu's are done. */ + call_rcu(&ngrp->rcu, vlan_rcu_free); + } return err; }