]> git.baikalelectronics.ru Git - kernel.git/commit
macsec: use after free when deleting the underlying device
authorSabrina Dubroca <sd@queasysnail.net>
Thu, 11 Aug 2016 13:24:27 +0000 (15:24 +0200)
committerDavid S. Miller <davem@davemloft.net>
Thu, 11 Aug 2016 16:58:57 +0000 (09:58 -0700)
commitda0438e2f9d7c47c095a8a530233ae7f42b3d399
tree6cfcbd774a34d469cbe811424095f3c0807db577
parent27eb7d2b9d307c73153186e452c715e06ee9b199
macsec: use after free when deleting the underlying device

macsec_notify() loops over the list of macsec devices configured on the
underlying device when this device is being removed.  This list is part
of the rx_handler data.

However, macsec_dellink unregisters the rx_handler and frees the
rx_handler data when the last macsec device is removed from the
underlying device.

Add macsec_common_dellink() to delete macsec devices without
unregistering the rx_handler and freeing the associated data.

Fixes: 86f09dc2c6bc ("macsec: fix memory leaks around rx_handler (un)registration")
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/net/macsec.c