diff options
| author | Eric Dumazet <edumazet@google.com> | 2019-05-28 02:56:48 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-01-29 12:21:44 +0300 |
| commit | 28dd951dc30615799a1b23e456444494ae80edc0 (patch) | |
| tree | 913073f8570ceab9155b0d3a4a17d1917c59288e /net | |
| parent | 8abf19b6ab8bc65cb28e9595cce61274c6e4d88b (diff) | |
| download | linux-28dd951dc30615799a1b23e456444494ae80edc0.tar.xz | |
inet: frags: call inet_frags_fini() after unregister_pernet_subsys()
[ Upstream commit ae7352d384a552d8c799c242e74a934809990a71 ]
Both IPv6 and 6lowpan are calling inet_frags_fini() too soon.
inet_frags_fini() is dismantling a kmem_cache, that might be needed
later when unregister_pernet_subsys() eventually has to remove
frags queues from hash tables and free them.
This fixes potential use-after-free, and is a prereq for the following patch.
Fixes: d4ad4d22e7ac ("inet: frags: use kmem_cache for inet_frag_queue")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/ieee802154/6lowpan/reassembly.c | 2 | ||||
| -rw-r--r-- | net/ipv6/reassembly.c | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/net/ieee802154/6lowpan/reassembly.c b/net/ieee802154/6lowpan/reassembly.c index 6183730d38db..e728dae467c3 100644 --- a/net/ieee802154/6lowpan/reassembly.c +++ b/net/ieee802154/6lowpan/reassembly.c @@ -634,7 +634,7 @@ err_sysctl: void lowpan_net_frag_exit(void) { - inet_frags_fini(&lowpan_frags); lowpan_frags_sysctl_unregister(); unregister_pernet_subsys(&lowpan_frags_ops); + inet_frags_fini(&lowpan_frags); } diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c index ec917f58d105..17e9ed2edb86 100644 --- a/net/ipv6/reassembly.c +++ b/net/ipv6/reassembly.c @@ -774,8 +774,8 @@ err_protocol: void ipv6_frag_exit(void) { - inet_frags_fini(&ip6_frags); ip6_frags_sysctl_unregister(); unregister_pernet_subsys(&ip6_frags_ops); inet6_del_protocol(&frag_protocol, IPPROTO_FRAGMENT); + inet_frags_fini(&ip6_frags); } |