From 42d000143b2e4d7111ae92672aa1916f33bb5913 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Uwe=20Kleine-K=C3=B6nig?= Date: Wed, 10 Aug 2016 11:44:17 +0200 Subject: [PATCH] net: ipconfig: fix use after free MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit ic_close_devs() calls kfree() for all devices's ic_device. Since commit 381cb4518d2a ("net: ipconfig: Support using "delayed" DHCP replies") the active device's ic_device is still used however to print the ipconfig summary which results in an oops if the memory is already changed. So delay freeing until after the autoconfig results are reported. Fixes: 381cb4518d2a ("net: ipconfig: Support using "delayed" DHCP replies") Reported-by: Geert Uytterhoeven Signed-off-by: Uwe Kleine-König Tested-by: Geert Uytterhoeven Signed-off-by: David S. Miller --- net/ipv4/ipconfig.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c index 42cf629357b58..66c2fe602810e 100644 --- a/net/ipv4/ipconfig.c +++ b/net/ipv4/ipconfig.c @@ -1492,14 +1492,6 @@ static int __init ip_auto_config(void) if (ic_defaults() < 0) return -1; - /* - * Close all network devices except the device we've - * autoconfigured and set up routes. - */ - ic_close_devs(); - if (ic_setup_if() < 0 || ic_setup_routes() < 0) - return -1; - /* * Record which protocol was actually used. */ @@ -1534,6 +1526,15 @@ static int __init ip_auto_config(void) pr_cont("\n"); #endif /* !SILENT */ + /* + * Close all network devices except the device we've + * autoconfigured and set up routes. + */ + ic_close_devs(); + if (ic_setup_if() < 0 || ic_setup_routes() < 0) + return -1; + + return 0; } -- 2.39.5