| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Wed, 24 Nov 2010 16:35:41 +0100 From: Anders Franzen <anders.franzen@...csson.com> To: <kaber@...sh.net> CC: <netdev@...r.kernel.org>, <eric.dumazet@...il.com>, <davem@...emloft.net>, Anders Franzen <anders.franzen@...csson.com> Subject: [PATCH] the macvlan device causes SLAB corruption on network namespace exit. When doing exit from a network namespace, cleanup functions are executed from the function default_device_exit_batch. In the macvlan device, this will generate a call to macvlan_dellink. If it is the last macvlan using a ''lowerdev'' the port is destroyed. Later the a call to macvlan_stop is executed. when the macvlan_hash_del(vlan) is executed, the memory of the already freed port will be corrupted. Signed-off-by: Anders Franzen <anders.franzen@...csson.com> --- drivers/net/macvlan.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c index 6ed577b..c1cddb6 100644 --- a/drivers/net/macvlan.c +++ b/drivers/net/macvlan.c @@ -338,7 +338,9 @@ static int macvlan_stop(struct net_device *dev) dev_uc_del(lowerdev, dev->dev_addr); hash_del: - macvlan_hash_del(vlan); + if (macvlan_port_exists(lowerdev)) + macvlan_hash_del(vlan); + return 0; } -- 1.7.2.3 -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists