| commit | bbe11fab0b6c1d113776b2898e085bf4d1fdc607 | |
| author | Sabrina Dubroca <sd@queasysnail.net> | |
| Thu, 11 Aug 2016 13:24:27 +0000 (11 15:24 +0200) | ||
| committer | David S. Miller <davem@davemloft.net> | |
| Thu, 11 Aug 2016 16:58:57 +0000 (11 09:58 -0700) | ||
| tree | 6cfcbd774a34d469cbe811424095f3c0807db577 | treesnapshot (tar.gz zip) |
| parent | 104a493390940e85fb7c840a9fd5214aba5cb3bd | commitdiff |
macsec: use after free when deleting the underlying device
macsec_notify() loops over the list of macsec devices configured on the
underlying device when this device is being removed. This list is part
of the rx_handler data.
However, macsec_dellink unregisters the rx_handler and frees the
rx_handler data when the last macsec device is removed from the
underlying device.
Add macsec_common_dellink() to delete macsec devices without
unregistering the rx_handler and freeing the associated data.
Fixes: 960d5848dbf1 ("macsec: fix memory leaks around rx_handler (un)registration")
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
macsec_notify() loops over the list of macsec devices configured on the
underlying device when this device is being removed. This list is part
of the rx_handler data.
However, macsec_dellink unregisters the rx_handler and frees the
rx_handler data when the last macsec device is removed from the
underlying device.
Add macsec_common_dellink() to delete macsec devices without
unregistering the rx_handler and freeing the associated data.
Fixes: 960d5848dbf1 ("macsec: fix memory leaks around rx_handler (un)registration")
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
| drivers/net/macsec.c | diffblobblamehistory |