netpoll: fix use after free
authordavid decotigny <decot@googlers.com>
Tue, 8 Jul 2014 22:14:41 +0000 (15:14 -0700)
committerDavid S. Miller <davem@davemloft.net>
Wed, 9 Jul 2014 03:50:53 +0000 (20:50 -0700)
After a bonding master reclaims the netpoll info struct, slaves could
still hold a pointer to the reclaimed data. This patch fixes it: as
soon as netpoll_async_cleanup is called for a slave (eg. when
un-enslaved), we make sure that this slave doesn't point to the data.

Signed-off-by: David Decotigny <decot@googlers.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/core/netpoll.c

index e33937fb32a0ceac413ac369d2991a92c3428235..907fb5e36c02e54794734abe4dc1225bf9af9c7d 100644 (file)
@@ -822,7 +822,8 @@ void __netpoll_cleanup(struct netpoll *np)
 
                RCU_INIT_POINTER(np->dev->npinfo, NULL);
                call_rcu_bh(&npinfo->rcu, rcu_cleanup_netpoll_info);
-       }
+       } else
+               RCU_INIT_POINTER(np->dev->npinfo, NULL);
 }
 EXPORT_SYMBOL_GPL(__netpoll_cleanup);