Re: [PATCH] bonding: Fix use after free in unregister path
* Jeff Garzik ([EMAIL PROTECTED]) wrote: > Jay Vosburgh wrote: > > The following patch (based on a patch from Stephen Hemminger > ><[EMAIL PROTECTED]>) removes use after free conditions in > >the unregister path for the bonding master. Without this patch, an > >operation of the form "echo -bond0 > /sys/class/net/bonding_masters" > >would trigger a NULL pointer dereference in sysfs. I was not able to > >induce the failure with the non-sysfs code path, but for consistency I > >updated that code as well. > > > > I also did some testing of the bonding /proc file being open > >while the bond is being deleted, and didn't see any problems there. > > > >Signed-off-by: Jay Vosburgh <[EMAIL PROTECTED]> > > applied to #upstream-fixes This was originally discovered on 2.6.21.5 IIRC, so plan to send this to -stable as well? thanks, -chris - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Re: [PATCH] bonding: Fix use after free in unregister path
Jay Vosburgh wrote: The following patch (based on a patch from Stephen Hemminger <[EMAIL PROTECTED]>) removes use after free conditions in the unregister path for the bonding master. Without this patch, an operation of the form "echo -bond0 > /sys/class/net/bonding_masters" would trigger a NULL pointer dereference in sysfs. I was not able to induce the failure with the non-sysfs code path, but for consistency I updated that code as well. I also did some testing of the bonding /proc file being open while the bond is being deleted, and didn't see any problems there. Signed-off-by: Jay Vosburgh <[EMAIL PROTECTED]> applied to #upstream-fixes - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Re: [PATCH] bonding: Fix use after free in unregister path
Jay Vosburgh wrote: The following patch (based on a patch from Stephen Hemminger [EMAIL PROTECTED]) removes use after free conditions in the unregister path for the bonding master. Without this patch, an operation of the form echo -bond0 /sys/class/net/bonding_masters would trigger a NULL pointer dereference in sysfs. I was not able to induce the failure with the non-sysfs code path, but for consistency I updated that code as well. I also did some testing of the bonding /proc file being open while the bond is being deleted, and didn't see any problems there. Signed-off-by: Jay Vosburgh [EMAIL PROTECTED] applied to #upstream-fixes - To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Re: [PATCH] bonding: Fix use after free in unregister path
* Jeff Garzik ([EMAIL PROTECTED]) wrote: Jay Vosburgh wrote: The following patch (based on a patch from Stephen Hemminger [EMAIL PROTECTED]) removes use after free conditions in the unregister path for the bonding master. Without this patch, an operation of the form echo -bond0 /sys/class/net/bonding_masters would trigger a NULL pointer dereference in sysfs. I was not able to induce the failure with the non-sysfs code path, but for consistency I updated that code as well. I also did some testing of the bonding /proc file being open while the bond is being deleted, and didn't see any problems there. Signed-off-by: Jay Vosburgh [EMAIL PROTECTED] applied to #upstream-fixes This was originally discovered on 2.6.21.5 IIRC, so plan to send this to -stable as well? thanks, -chris - To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH] bonding: Fix use after free in unregister path
The following patch (based on a patch from Stephen Hemminger <[EMAIL PROTECTED]>) removes use after free conditions in the unregister path for the bonding master. Without this patch, an operation of the form "echo -bond0 > /sys/class/net/bonding_masters" would trigger a NULL pointer dereference in sysfs. I was not able to induce the failure with the non-sysfs code path, but for consistency I updated that code as well. I also did some testing of the bonding /proc file being open while the bond is being deleted, and didn't see any problems there. Signed-off-by: Jay Vosburgh <[EMAIL PROTECTED]> diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c index 223517d..6287ffb 100644 --- a/drivers/net/bonding/bond_main.c +++ b/drivers/net/bonding/bond_main.c @@ -4345,8 +4345,8 @@ static void bond_free_all(void) bond_mc_list_destroy(bond); /* Release the bonded slaves */ bond_release_all(bond_dev); - unregister_netdevice(bond_dev); bond_deinit(bond_dev); + unregister_netdevice(bond_dev); } #ifdef CONFIG_PROC_FS diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c index a122baa..60cccf2 100644 --- a/drivers/net/bonding/bond_sysfs.c +++ b/drivers/net/bonding/bond_sysfs.c @@ -164,9 +164,9 @@ static ssize_t bonding_store_bonds(struct class *cls, const char *buffer, size_t printk(KERN_INFO DRV_NAME ": %s is being deleted...\n", bond->dev->name); - unregister_netdevice(bond->dev); bond_deinit(bond->dev); bond_destroy_sysfs_entry(bond); + unregister_netdevice(bond->dev); rtnl_unlock(); goto out; } - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH] bonding: Fix use after free in unregister path
The following patch (based on a patch from Stephen Hemminger [EMAIL PROTECTED]) removes use after free conditions in the unregister path for the bonding master. Without this patch, an operation of the form echo -bond0 /sys/class/net/bonding_masters would trigger a NULL pointer dereference in sysfs. I was not able to induce the failure with the non-sysfs code path, but for consistency I updated that code as well. I also did some testing of the bonding /proc file being open while the bond is being deleted, and didn't see any problems there. Signed-off-by: Jay Vosburgh [EMAIL PROTECTED] diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c index 223517d..6287ffb 100644 --- a/drivers/net/bonding/bond_main.c +++ b/drivers/net/bonding/bond_main.c @@ -4345,8 +4345,8 @@ static void bond_free_all(void) bond_mc_list_destroy(bond); /* Release the bonded slaves */ bond_release_all(bond_dev); - unregister_netdevice(bond_dev); bond_deinit(bond_dev); + unregister_netdevice(bond_dev); } #ifdef CONFIG_PROC_FS diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c index a122baa..60cccf2 100644 --- a/drivers/net/bonding/bond_sysfs.c +++ b/drivers/net/bonding/bond_sysfs.c @@ -164,9 +164,9 @@ static ssize_t bonding_store_bonds(struct class *cls, const char *buffer, size_t printk(KERN_INFO DRV_NAME : %s is being deleted...\n, bond-dev-name); - unregister_netdevice(bond-dev); bond_deinit(bond-dev); bond_destroy_sysfs_entry(bond); + unregister_netdevice(bond-dev); rtnl_unlock(); goto out; } - To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
