bridge: fix use-after-free in br_cleanup_bridges()

[Patrick McHardy <kaber@trash.net>]

[-- Attachment #1: Type: text/plain, Size: 0 bytes --]



[-- Attachment #2: x --]
[-- Type: text/plain, Size: 1403 bytes --]

commit 96f1dd78dad10d61bdd487edadea6adda5425e4c
Author: Patrick McHardy <kaber@trash.net>
Date:   Wed Jul 2 15:02:23 2008 +0200

    bridge: fix use-after-free in br_cleanup_bridges()

    Unregistering a bridge device may cause virtual devices stacked on the
    bridge, like vlan or macvlan devices, to be unregistered as well.
    br_cleanup_bridges() uses for_each_netdev_safe() to iterate over all
    devices during cleanup. This is not enough however, if one of the
    additionally unregistered devices is next in the list to the bridge
    device, it will get freed as well and the iteration continues on
    the freed element.

    Restart iteration after each bridge device removal from the beginning to
    fix this, similar to what rtnl_link_unregister() does.

    Signed-off-by: Patrick McHardy <kaber@trash.net>

diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index c2397f5..f38cc53 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -442,12 +442,16 @@ int br_del_if(struct net_bridge *br, struct net_device *dev)
 
 void __exit br_cleanup_bridges(void)
 {
-	struct net_device *dev, *nxt;
+	struct net_device *dev;
 
 	rtnl_lock();
-	for_each_netdev_safe(&init_net, dev, nxt)
-		if (dev->priv_flags & IFF_EBRIDGE)
+restart:
+	for_each_netdev(&init_net, dev) {
+		if (dev->priv_flags & IFF_EBRIDGE) {
 			del_br(dev->priv);
+			goto restart;
+		}
+	}
 	rtnl_unlock();
 
 }