summaryrefslogtreecommitdiff
path: root/net/ipv4/ipconfig.c
diff options
context:
space:
mode:
authorUwe Kleine-König <u.kleine-koenig@pengutronix.de>2016-08-10 12:44:17 +0300
committerDavid S. Miller <davem@davemloft.net>2016-08-11 00:04:23 +0300
commit9c706a49d660653625d206f6972541c1f60ea2b0 (patch)
treefd524586607f08d65224d3bb0a3e175c8e47f1e2 /net/ipv4/ipconfig.c
parent0184165b2f42c4b032da9dd11546bfbaeb5afd4e (diff)
downloadlinux-9c706a49d660653625d206f6972541c1f60ea2b0.tar.xz
net: ipconfig: fix use after free
ic_close_devs() calls kfree() for all devices's ic_device. Since commit 2647cffb2bc6 ("net: ipconfig: Support using "delayed" DHCP replies") the active device's ic_device is still used however to print the ipconfig summary which results in an oops if the memory is already changed. So delay freeing until after the autoconfig results are reported. Fixes: 2647cffb2bc6 ("net: ipconfig: Support using "delayed" DHCP replies") Reported-by: Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Tested-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/ipconfig.c')
-rw-r--r--net/ipv4/ipconfig.c17
1 files changed, 9 insertions, 8 deletions
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index 42cf629357b5..66c2fe602810 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -1493,14 +1493,6 @@ static int __init ip_auto_config(void)
return -1;
/*
- * Close all network devices except the device we've
- * autoconfigured and set up routes.
- */
- ic_close_devs();
- if (ic_setup_if() < 0 || ic_setup_routes() < 0)
- return -1;
-
- /*
* Record which protocol was actually used.
*/
#ifdef IPCONFIG_DYNAMIC
@@ -1534,6 +1526,15 @@ static int __init ip_auto_config(void)
pr_cont("\n");
#endif /* !SILENT */
+ /*
+ * Close all network devices except the device we've
+ * autoconfigured and set up routes.
+ */
+ ic_close_devs();
+ if (ic_setup_if() < 0 || ic_setup_routes() < 0)
+ return -1;
+
+
return 0;
}