aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorNikolay Aleksandrov <nikolay@redhat.com>2013-09-19 15:02:35 +0200
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2013-10-13 14:51:07 -0700
commitf6f88d6f41938e39971a5c0fce3aa8d26d3dd9de (patch)
treedbf36ef28dc8806b3f788cfa7267892bf8232121
parent63195262c5555dc90fde66d1be41ab102cf00adb (diff)
downloadkernel_samsung_smdk4412-f6f88d6f41938e39971a5c0fce3aa8d26d3dd9de.zip
kernel_samsung_smdk4412-f6f88d6f41938e39971a5c0fce3aa8d26d3dd9de.tar.gz
kernel_samsung_smdk4412-f6f88d6f41938e39971a5c0fce3aa8d26d3dd9de.tar.bz2
netpoll: fix NULL pointer dereference in netpoll_cleanup
[ Upstream commit d0fe8c888b1fd1a2f84b9962cabcb98a70988aec ] I've been hitting a NULL ptr deref while using netconsole because the np->dev check and the pointer manipulation in netpoll_cleanup are done without rtnl and the following sequence happens when having a netconsole over a vlan and we remove the vlan while disabling the netconsole: CPU 1 CPU2 removes vlan and calls the notifier enters store_enabled(), calls netdev_cleanup which checks np->dev and then waits for rtnl executes the netconsole netdev release notifier making np->dev == NULL and releases rtnl continues to dereference a member of np->dev which at this point is == NULL Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--net/core/netpoll.c9
1 files changed, 4 insertions, 5 deletions
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 207a178..c497137 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -927,15 +927,14 @@ EXPORT_SYMBOL_GPL(__netpoll_cleanup);
void netpoll_cleanup(struct netpoll *np)
{
- if (!np->dev)
- return;
-
rtnl_lock();
+ if (!np->dev)
+ goto out;
__netpoll_cleanup(np);
- rtnl_unlock();
-
dev_put(np->dev);
np->dev = NULL;
+out:
+ rtnl_unlock();
}
EXPORT_SYMBOL(netpoll_cleanup);