Commit 30df94f8 authored Sep 28, 2009 by Jeff Hansen Committed by David S. Miller Sep 28, 2009

bridge: Fix double-free in br_add_if.



There is a potential double-kfree in net/bridge/br_if.c.  If br_fdb_insert
fails, then the kobject is put back (which calls kfree due to the kobject
release), and then kfree is called again on the net_bridge_port.  This
patch fixes the crash.

Thanks to Stephen Hemminger for the one-line fix.

Signed-off-by: Jeff Hansen <x@jeffhansen.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 8823ad31

net/bridge/br_if.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -432,6 +432,7 @@ int br_add_if(struct net_bridge br, struct net_device dev)
		br_fdb_delete_by_port(br, p, 1);
		err1:
		kobject_put(&p->kobj);
		p = NULL; /* kobject_put frees */
		err0:
		dev_set_promiscuity(dev, -1);
		put_back: