-
Eric Dumazet authored
ipmr_rules_exit() and ip6mr_rules_exit() free a list of items, but forget to properly remove these items from list. List head is not changed and still points to freed memory. This can trigger a fault later when icmpv6_sk_exit() is called. Fix is to either reinit list, or use list_del() to properly remove items from list before freeing them. bugzilla report : https://bugzilla.kernel.org/show_bug.cgi?id=16120 Introduced by commit d1db275d (ipv6: ip6mr: support multiple tables) and commit f0ad0860 (ipv4: ipmr: support multiple tables) Reported-by:
Alex Zhavnerchik <alex.vizor@gmail.com> Signed-off-by:
Eric Dumazet <eric.dumazet@gmail.com> CC: Patrick McHardy <kaber@trash.net> Signed-off-by:
David S. Miller <davem@davemloft.net>
035320d5