Attachment 181361 Details for Bug 268001 – Patch from upstream with offsets fixed for RHEL-5

[patch] Patch from upstream with offsets fixed for RHEL-5

linux-2.6-RHEL5-git-3201e656ce56ed02e9501906c18ffe16ae350a52.patch (text/plain), 2.08 KB, created by Flavio Leitner on 2007-08-30 16:49:55 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Flavio Leitner

Created: 2007-08-30 16:49:55 UTC

Size: 2.08 KB

patch

obsolete

>From: Jay Vosburgh <fubar@us.ibm.com>
>Date: Tue, 19 Jun 2007 18:12:12 +0000 (-0700)
>Subject: bonding: Fix use after free in unregister path
>X-Git-Tag: v2.6.22-rc6~62
>X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=3201e656ce56ed02e9501906c18ffe16ae350a52
>
>bonding: Fix use after free in unregister path
>
>	The following patch (based on a patch from Stephen Hemminger
><shemminger@linux-foundation.org>) removes use after free conditions in
>the unregister path for the bonding master.  Without this patch, an
>operation of the form "echo -bond0 > /sys/class/net/bonding_masters"
>would trigger a NULL pointer dereference in sysfs.  I was not able to
>induce the failure with the non-sysfs code path, but for consistency I
>updated that code as well.
>
>	I also did some testing of the bonding /proc file being open
>while the bond is being deleted, and didn't see any problems there.
>
>Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
>Signed-off-by: Jeff Garzik <jeff@garzik.org>
>---
>
>Index: linux-2.6.18.i686/drivers/net/bonding/bond_main.c
>===================================================================
>--- linux-2.6.18.i686.orig/drivers/net/bonding/bond_main.c
>+++ linux-2.6.18.i686/drivers/net/bonding/bond_main.c
>@@ -4431,8 +4431,8 @@ static void bond_free_all(void)
> 		bond_mc_list_destroy(bond);
> 		/* Release the bonded slaves */
> 		bond_release_all(bond_dev);
>-		unregister_netdevice(bond_dev);
> 		bond_deinit(bond_dev);
>+		unregister_netdevice(bond_dev);
> 	}
> 
> #ifdef CONFIG_PROC_FS
>Index: linux-2.6.18.i686/drivers/net/bonding/bond_sysfs.c
>===================================================================
>--- linux-2.6.18.i686.orig/drivers/net/bonding/bond_sysfs.c
>+++ linux-2.6.18.i686/drivers/net/bonding/bond_sysfs.c
>@@ -166,9 +166,9 @@ static ssize_t bonding_store_bonds(struc
> 				printk(KERN_INFO DRV_NAME
> 					": %s is being deleted...\n",
> 					bond->dev->name);
>-				unregister_netdevice(bond->dev);
> 				bond_deinit(bond->dev);
> 		        	bond_destroy_sysfs_entry(bond);
>+				unregister_netdevice(bond->dev);
> 				rtnl_unlock();
> 				goto out;
> 			}

Actions: View | Diff

Attachments on bug 268001: 181361 | 292974