Commit ab1b2046 authored by Patrick McHardy's avatar Patrick McHardy Committed by David S. Miller

bridge: fix use-after-free in br_cleanup_bridges()

Unregistering a bridge device may cause virtual devices stacked on the
bridge, like vlan or macvlan devices, to be unregistered as well.
br_cleanup_bridges() uses for_each_netdev_safe() to iterate over all
devices during cleanup. This is not enough however, if one of the
additionally unregistered devices is next in the list to the bridge
device, it will get freed as well and the iteration continues on
the freed element.

Restart iteration after each bridge device removal from the beginning to
fix this, similar to what rtnl_link_unregister() does.
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Acked-by: default avatarStephen Hemminger <shemminger@vyatta.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 374e7b59
...@@ -442,12 +442,16 @@ int br_del_if(struct net_bridge *br, struct net_device *dev) ...@@ -442,12 +442,16 @@ int br_del_if(struct net_bridge *br, struct net_device *dev)
void __exit br_cleanup_bridges(void) void __exit br_cleanup_bridges(void)
{ {
struct net_device *dev, *nxt; struct net_device *dev;
rtnl_lock(); rtnl_lock();
for_each_netdev_safe(&init_net, dev, nxt) restart:
if (dev->priv_flags & IFF_EBRIDGE) for_each_netdev(&init_net, dev) {
if (dev->priv_flags & IFF_EBRIDGE) {
del_br(dev->priv); del_br(dev->priv);
goto restart;
}
}
rtnl_unlock(); rtnl_unlock();
} }
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment