lkml.org 
[lkml]   [2020]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 226/343] inet: frags: call inet_frags_fini() after unregister_pernet_subsys()
    Date
    From: Eric Dumazet <edumazet@google.com>

    [ Upstream commit ae7352d384a552d8c799c242e74a934809990a71 ]

    Both IPv6 and 6lowpan are calling inet_frags_fini() too soon.

    inet_frags_fini() is dismantling a kmem_cache, that might be needed
    later when unregister_pernet_subsys() eventually has to remove
    frags queues from hash tables and free them.

    This fixes potential use-after-free, and is a prereq for the following patch.

    Fixes: d4ad4d22e7ac ("inet: frags: use kmem_cache for inet_frag_queue")
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/ieee802154/6lowpan/reassembly.c | 2 +-
    net/ipv6/reassembly.c | 2 +-
    2 files changed, 2 insertions(+), 2 deletions(-)

    diff --git a/net/ieee802154/6lowpan/reassembly.c b/net/ieee802154/6lowpan/reassembly.c
    index ec7a5da561290..e873a6a007f2a 100644
    --- a/net/ieee802154/6lowpan/reassembly.c
    +++ b/net/ieee802154/6lowpan/reassembly.c
    @@ -634,7 +634,7 @@ err_sysctl:

    void lowpan_net_frag_exit(void)
    {
    - inet_frags_fini(&lowpan_frags);
    lowpan_frags_sysctl_unregister();
    unregister_pernet_subsys(&lowpan_frags_ops);
    + inet_frags_fini(&lowpan_frags);
    }
    diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
    index fe797b29ca89d..6dea6e92e6863 100644
    --- a/net/ipv6/reassembly.c
    +++ b/net/ipv6/reassembly.c
    @@ -593,8 +593,8 @@ err_protocol:

    void ipv6_frag_exit(void)
    {
    - inet_frags_fini(&ip6_frags);
    ip6_frags_sysctl_unregister();
    unregister_pernet_subsys(&ip6_frags_ops);
    inet6_del_protocol(&frag_protocol, IPPROTO_FRAGMENT);
    + inet_frags_fini(&ip6_frags);
    }
    --
    2.20.1


    \
     
     \ /
      Last update: 2020-01-24 10:59    [W:4.603 / U:1.064 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site