Commit 9c706a49 authored by Uwe Kleine-König's avatar Uwe Kleine-König Committed by David S. Miller

net: ipconfig: fix use after free

ic_close_devs() calls kfree() for all devices's ic_device. Since commit
2647cffb ("net: ipconfig: Support using "delayed" DHCP replies")
the active device's ic_device is still used however to print the
ipconfig summary which results in an oops if the memory is already
changed. So delay freeing until after the autoconfig results are
reported.

Fixes: 2647cffb ("net: ipconfig: Support using "delayed" DHCP replies")
Reported-by: default avatarGeert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: default avatarUwe Kleine-König <u.kleine-koenig@pengutronix.de>
Tested-by: default avatarGeert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 0184165b
...@@ -1492,14 +1492,6 @@ static int __init ip_auto_config(void) ...@@ -1492,14 +1492,6 @@ static int __init ip_auto_config(void)
if (ic_defaults() < 0) if (ic_defaults() < 0)
return -1; return -1;
/*
* Close all network devices except the device we've
* autoconfigured and set up routes.
*/
ic_close_devs();
if (ic_setup_if() < 0 || ic_setup_routes() < 0)
return -1;
/* /*
* Record which protocol was actually used. * Record which protocol was actually used.
*/ */
...@@ -1534,6 +1526,15 @@ static int __init ip_auto_config(void) ...@@ -1534,6 +1526,15 @@ static int __init ip_auto_config(void)
pr_cont("\n"); pr_cont("\n");
#endif /* !SILENT */ #endif /* !SILENT */
/*
* Close all network devices except the device we've
* autoconfigured and set up routes.
*/
ic_close_devs();
if (ic_setup_if() < 0 || ic_setup_routes() < 0)
return -1;
return 0; return 0;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment