linux_old1/net/bridge
Patrick McHardy ab1b20467c bridge: fix use-after-free in br_cleanup_bridges()
Unregistering a bridge device may cause virtual devices stacked on the
bridge, like vlan or macvlan devices, to be unregistered as well.
br_cleanup_bridges() uses for_each_netdev_safe() to iterate over all
devices during cleanup. This is not enough however, if one of the
additionally unregistered devices is next in the list to the bridge
device, it will get freed as well and the iteration continues on
the freed element.

Restart iteration after each bridge device removal from the beginning to
fix this, similar to what rtnl_link_unregister() does.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Acked-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-07-03 03:53:42 -07:00
..
netfilter [NETFILTER]: bridge: add ebt_nflog watcher 2008-04-14 11:15:54 +02:00
Kconfig [BRIDGE]: use llc for receiving STP packets 2006-03-20 22:59:06 -08:00
Makefile [BRIDGE]: netlink interface for link management 2006-06-17 21:26:14 -07:00
br.c bridge: kernel panic when unloading bridge module 2008-04-29 03:18:13 -07:00
br_device.c [BRIDGE]: Assign random address. 2007-12-16 13:35:51 -08:00
br_fdb.c bridge: forwarding table information for >256 devices 2008-05-02 16:53:33 -07:00
br_forward.c [BRIDGE]: Kill clone argument to br_flood_* 2007-09-16 16:20:48 -07:00
br_if.c bridge: fix use-after-free in br_cleanup_bridges() 2008-07-03 03:53:42 -07:00
br_input.c [BRIDGE]: Use cpu_to_be16() where appropriate. 2008-01-28 14:58:00 -08:00
br_ioctl.c [NET]: Make the device list and device lookups per namespace. 2007-10-10 16:49:10 -07:00
br_netfilter.c Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2008-04-14 02:30:23 -07:00
br_netlink.c [NET] NETNS: Omit sock->sk_net without CONFIG_NET_NS. 2008-03-26 04:39:55 +09:00
br_notify.c [NET] NETNS: Omit net_device->nd_net without CONFIG_NET_NS. 2008-03-26 04:39:53 +09:00
br_private.h Kobject: change net/bridge to use kobject_create_and_add 2008-01-24 20:40:26 -08:00
br_private_stp.h Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
br_stp.c [BRIDGE]: Round off STP perodic timers. 2007-05-31 01:23:39 -07:00
br_stp_bpdu.c net: use get/put_unaligned_* helpers 2008-05-02 16:26:16 -07:00
br_stp_if.c [BRIDGE]: Fix typo in net/bridge/br_stp_if.c 2007-08-14 13:22:58 -07:00
br_stp_timer.c [BRIDGE]: Round off STP perodic timers. 2007-05-31 01:23:39 -07:00
br_sysfs_br.c net: replace remaining __FUNCTION__ occurrences 2008-03-05 20:47:47 -08:00
br_sysfs_if.c Kobject: change net/bridge to use kobject_create_and_add 2008-01-24 20:40:26 -08:00