[PATCH] bonding: Fix resource use after free

Previous thread: Hello!! by THUNDERBALL END OF YEAR BONANZA on Monday, November 12, 2007 - 9:39 pm. (1 message)

Next thread: [BUG] New Kernel Bugs by Natalie Protasevich on Tuesday, November 13, 2007 - 2:42 am. (153 messages)
To: <netdev@...>
Cc: <davem@...>, <jgarzik@...>, <monis@...>, Jay Vosburgh <fubar@...>
Date: Monday, November 12, 2007 - 10:15 pm

Fix bond_destroy and bond_free_all to not reference the
struct net_device after calling unregister_netdevice.

Bug and offending change reported by Moni Shoua <monis@voltaire.com>

Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>

---

Copying DaveM since Jeff is out this week; please apply for 2.6.24.

-J

drivers/net/bonding/bond_main.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index a198404..423298c 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1847,9 +1847,9 @@ int bond_release(struct net_device *bond_dev, struct net_device *slave_dev)
*/
void bond_destroy(struct bonding *bond)
{
- unregister_netdevice(bond->dev);
bond_deinit(bond->dev);
bond_destroy_sysfs_entry(bond);
+ unregister_netdevice(bond->dev);
}

/*
@@ -4475,8 +4475,8 @@ static void bond_free_all(void)
bond_mc_list_destroy(bond);
/* Release the bonded slaves */
bond_release_all(bond_dev);
- unregister_netdevice(bond_dev);
bond_deinit(bond_dev);
+ unregister_netdevice(bond_dev);
}

#ifdef CONFIG_PROC_FS
--
1.5.3.1

-

To: <fubar@...>
Cc: <netdev@...>, <jgarzik@...>, <monis@...>
Date: Wednesday, November 14, 2007 - 1:16 am

From: Jay Vosburgh <fubar@us.ibm.com>

Applied to net-2.6, thanks Jay.
-

Previous thread: Hello!! by THUNDERBALL END OF YEAR BONANZA on Monday, November 12, 2007 - 9:39 pm. (1 message)

Next thread: [BUG] New Kernel Bugs by Natalie Protasevich on Tuesday, November 13, 2007 - 2:42 am. (153 messages)