Commit efa95b01 authored Jul 08, 2014 by david decotigny Committed by David S. Miller Jul 08, 2014

netpoll: fix use after free

After a bonding master reclaims the netpoll info struct, slaves could
still hold a pointer to the reclaimed data. This patch fixes it: as
soon as netpoll_async_cleanup is called for a slave (eg. when
un-enslaved), we make sure that this slave doesn't point to the data.

Signed-off-by: David Decotigny <decot@googlers.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent f51de243

net/core/netpoll.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -822,7 +822,8 @@ void __netpoll_cleanup(struct netpoll *np)

		RCU_INIT_POINTER(np->dev->npinfo, NULL);
		call_rcu_bh(&npinfo->rcu, rcu_cleanup_netpoll_info);
		}
		} else
		RCU_INIT_POINTER(np->dev->npinfo, NULL);
		}
		EXPORT_SYMBOL_GPL(__netpoll_cleanup);