Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ae7352d3 authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

inet: frags: call inet_frags_fini() after unregister_pernet_subsys() 



Both IPv6 and 6lowpan are calling inet_frags_fini() too soon.

inet_frags_fini() is dismantling a kmem_cache, that might be needed
later when unregister_pernet_subsys() eventually has to remove
frags queues from hash tables and free them.

This fixes potential use-after-free, and is a prereq for the following patch.

Fixes: d4ad4d22 ("inet: frags: use kmem_cache for inet_frag_queue")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 6b73d197

net/ieee802154/6lowpan/reassembly.c

+1 −1
Original line number Diff line number Diff line
@@ -540,7 +540,7 @@ int __init lowpan_net_frag_init(void) 


void lowpan_net_frag_exit(void)

{

	inet_frags_fini(&lowpan_frags);

	lowpan_frags_sysctl_unregister();

	unregister_pernet_subsys(&lowpan_frags_ops);

	inet_frags_fini(&lowpan_frags);

}

net/ipv6/reassembly.c

+1 −1
Original line number Diff line number Diff line
@@ -583,8 +583,8 @@ int __init ipv6_frag_init(void) 


void ipv6_frag_exit(void)

{

	inet_frags_fini(&ip6_frags);

	ip6_frags_sysctl_unregister();

	unregister_pernet_subsys(&ip6_frags_ops);

	inet6_del_protocol(&frag_protocol, IPPROTO_FRAGMENT);

	inet_frags_fini(&ip6_frags);

}