Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1760638AbXFSSMd (ORCPT ); Tue, 19 Jun 2007 14:12:33 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1759084AbXFSSMX (ORCPT ); Tue, 19 Jun 2007 14:12:23 -0400 Received: from e31.co.us.ibm.com ([32.97.110.149]:60305 "EHLO e31.co.us.ibm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756747AbXFSSMV (ORCPT ); Tue, 19 Jun 2007 14:12:21 -0400 To: Jeff Garzik cc: Stephen Hemminger , "David S. Miller" , Dan Aloni , Chad Tindel , Kenji Kaneshige , netdev@vger.kernel.org, linux-kernel , Andrew Morton , bonding-devel@lists.sourceforge.net Subject: [PATCH] bonding: Fix use after free in unregister path In-reply-to: <467817CE.80904@garzik.org> References: <1178862045.3979.33.camel@kane-linux> <20070511092519.1f34ab34@freepuppy> <1179130660.3881.23.camel@kane-linux> <20070514085840.17a343f7@freepuppy> <20070613094521.GA8860@localdomain> <20070613155335.47111c67@localhost> <15712.1181795790@death> <20070619082302.4b9a5c27@localhost.localdomain> <467817CE.80904@garzik.org> Comments: In-reply-to Jeff Garzik message dated "Tue, 19 Jun 2007 13:52:14 -0400." X-Mailer: MH-E 8.0.3; nmh 1.1-RC4; GNU Emacs 22.0.95 Date: Tue, 19 Jun 2007 11:12:12 -0700 Message-ID: <24302.1182276732@death> From: Jay Vosburgh Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1895 Lines: 48 The following patch (based on a patch from Stephen Hemminger ) removes use after free conditions in the unregister path for the bonding master. Without this patch, an operation of the form "echo -bond0 > /sys/class/net/bonding_masters" would trigger a NULL pointer dereference in sysfs. I was not able to induce the failure with the non-sysfs code path, but for consistency I updated that code as well. I also did some testing of the bonding /proc file being open while the bond is being deleted, and didn't see any problems there. Signed-off-by: Jay Vosburgh diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c index 223517d..6287ffb 100644 --- a/drivers/net/bonding/bond_main.c +++ b/drivers/net/bonding/bond_main.c @@ -4345,8 +4345,8 @@ static void bond_free_all(void) bond_mc_list_destroy(bond); /* Release the bonded slaves */ bond_release_all(bond_dev); - unregister_netdevice(bond_dev); bond_deinit(bond_dev); + unregister_netdevice(bond_dev); } #ifdef CONFIG_PROC_FS diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c index a122baa..60cccf2 100644 --- a/drivers/net/bonding/bond_sysfs.c +++ b/drivers/net/bonding/bond_sysfs.c @@ -164,9 +164,9 @@ static ssize_t bonding_store_bonds(struct class *cls, const char *buffer, size_t printk(KERN_INFO DRV_NAME ": %s is being deleted...\n", bond->dev->name); - unregister_netdevice(bond->dev); bond_deinit(bond->dev); bond_destroy_sysfs_entry(bond); + unregister_netdevice(bond->dev); rtnl_unlock(); goto out; } - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/