From: Stephen Hemminger <shemminger@vyatta.com>
To: Patrick McHardy <kaber@trash.net>
Cc: Linux Netdev List <netdev@vger.kernel.org>,
bridge@lists.linux-foundation.org,
"David S. Miller" <davem@davemloft.net>
Subject: Re: [Bridge] bridge: fix use-after-free in br_cleanup_bridges()
Date: Wed, 2 Jul 2008 09:48:17 -0700 [thread overview]
Message-ID: <20080702094817.646c6c60@extreme> (raw)
In-Reply-To: <486B7CCE.2@trash.net>
On Wed, 02 Jul 2008 15:04:14 +0200
Patrick McHardy <kaber@trash.net> wrote:
> commit 96f1dd78dad10d61bdd487edadea6adda5425e4c
> Author: Patrick McHardy <kaber@trash.net>
> Date: Wed Jul 2 15:02:23 2008 +0200
>
> bridge: fix use-after-free in br_cleanup_bridges()
>
> Unregistering a bridge device may cause virtual devices stacked on the
> bridge, like vlan or macvlan devices, to be unregistered as well.
> br_cleanup_bridges() uses for_each_netdev_safe() to iterate over all
> devices during cleanup. This is not enough however, if one of the
> additionally unregistered devices is next in the list to the bridge
> device, it will get freed as well and the iteration continues on
> the freed element.
>
> Restart iteration after each bridge device removal from the beginning to
> fix this, similar to what rtnl_link_unregister() does.
>
> Signed-off-by: Patrick McHardy <kaber@trash.net>
Acked-by: Stephen Hemminger <shemminger@vyatta.com>
WARNING: multiple messages have this Message-ID (diff)
From: Stephen Hemminger <shemminger@vyatta.com>
To: Patrick McHardy <kaber@trash.net>
Cc: "David S. Miller" <davem@davemloft.net>,
Linux Netdev List <netdev@vger.kernel.org>,
bridge@lists.linux-foundation.org
Subject: Re: bridge: fix use-after-free in br_cleanup_bridges()
Date: Wed, 2 Jul 2008 09:48:17 -0700 [thread overview]
Message-ID: <20080702094817.646c6c60@extreme> (raw)
In-Reply-To: <486B7CCE.2@trash.net>
On Wed, 02 Jul 2008 15:04:14 +0200
Patrick McHardy <kaber@trash.net> wrote:
> commit 96f1dd78dad10d61bdd487edadea6adda5425e4c
> Author: Patrick McHardy <kaber@trash.net>
> Date: Wed Jul 2 15:02:23 2008 +0200
>
> bridge: fix use-after-free in br_cleanup_bridges()
>
> Unregistering a bridge device may cause virtual devices stacked on the
> bridge, like vlan or macvlan devices, to be unregistered as well.
> br_cleanup_bridges() uses for_each_netdev_safe() to iterate over all
> devices during cleanup. This is not enough however, if one of the
> additionally unregistered devices is next in the list to the bridge
> device, it will get freed as well and the iteration continues on
> the freed element.
>
> Restart iteration after each bridge device removal from the beginning to
> fix this, similar to what rtnl_link_unregister() does.
>
> Signed-off-by: Patrick McHardy <kaber@trash.net>
Acked-by: Stephen Hemminger <shemminger@vyatta.com>
next prev parent reply other threads:[~2008-07-02 16:48 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-07-02 13:04 [Bridge] bridge: fix use-after-free in br_cleanup_bridges() Patrick McHardy
2008-07-02 13:04 ` Patrick McHardy
2008-07-02 16:48 ` Stephen Hemminger [this message]
2008-07-02 16:48 ` Stephen Hemminger
2008-07-03 10:54 ` [Bridge] " David Miller
2008-07-03 10:54 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20080702094817.646c6c60@extreme \
--to=shemminger@vyatta.com \
--cc=bridge@lists.linux-foundation.org \
--cc=davem@davemloft.net \
--cc=kaber@trash.net \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.