brain-hackers_pepepper-mirror/linux-brain
1
0
Fork 0
mirror of https://github.com/brain-hackers/linux-brain.git synced 2024-06-09 23:36:23 +09:00
Code Issues Projects Releases Wiki Activity

inet: frags: call inet_frags_fini() after unregister_pernet_subsys()

Browse Source 
[ Upstream commit ae7352d384 ]

Both IPv6 and 6lowpan are calling inet_frags_fini() too soon.

inet_frags_fini() is dismantling a kmem_cache, that might be needed
later when unregister_pernet_subsys() eventually has to remove
frags queues from hash tables and free them.

This fixes potential use-after-free, and is a prereq for the following patch.

Fixes: d4ad4d22e7 ("inet: frags: use kmem_cache for inet_frag_queue")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Eric Dumazet 2019-05-27 16:56:48 -07:00 committed by Greg Kroah-Hartman
parent 9360b13308
commit 4f80b033f6
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
net/ieee802154/6lowpan/reassembly.c
View File

@ -634,7 +634,7 @@ int __init lowpan_net_frag_init(void)
void lowpan_net_frag_exit(void)
{
inet_frags_fini(&lowpan_frags);
lowpan_frags_sysctl_unregister();
unregister_pernet_subsys(&lowpan_frags_ops);
inet_frags_fini(&lowpan_frags);
}

2
net/ipv6/reassembly.c
View File

@ -593,8 +593,8 @@ int __init ipv6_frag_init(void)
void ipv6_frag_exit(void)
{
inet_frags_fini(&ip6_frags);
ip6_frags_sysctl_unregister();
unregister_pernet_subsys(&ip6_frags_ops);
inet6_del_protocol(&frag_protocol, IPPROTO_FRAGMENT);
inet_frags_fini(&ip6_frags);
}