]> git.baikalelectronics.ru Git - kernel.git/commit
net: ipconfig: fix use after free
authorUwe Kleine-König <u.kleine-koenig@pengutronix.de>
Wed, 10 Aug 2016 09:44:17 +0000 (11:44 +0200)
committerDavid S. Miller <davem@davemloft.net>
Wed, 10 Aug 2016 21:04:23 +0000 (14:04 -0700)
commit592f11a8029654b56bc55979af4c150af011ae36
treefd524586607f08d65224d3bb0a3e175c8e47f1e2
parent2297a0d5091b6296477cb8d9e3f96efd6edc449e
net: ipconfig: fix use after free

ic_close_devs() calls kfree() for all devices's ic_device. Since commit
78f6c32fba8d ("net: ipconfig: Support using "delayed" DHCP replies")
the active device's ic_device is still used however to print the
ipconfig summary which results in an oops if the memory is already
changed. So delay freeing until after the autoconfig results are
reported.

Fixes: 78f6c32fba8d ("net: ipconfig: Support using "delayed" DHCP replies")
Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv4/ipconfig.c