aboutsummaryrefslogtreecommitdiff
path: root/net/core/dev.c
diff options
context:
space:
mode:
authorEric Dumazet <eric.dumazet@gmail.com>2011-02-17 22:59:19 +0000
committerGreg Kroah-Hartman <gregkh@suse.de>2011-03-21 12:45:11 -0700
commit6512cf6e927885eab153868b8daba1ecb53f3267 (patch)
treea21f9290d9c048e9f29ec693a8f5d5f9798fb4a5 /net/core/dev.c
parent9cab3cdd60c929dfe4c5ce641a2530fe8b27a89d (diff)
net: deinit automatic LIST_HEAD
commit ceaaec98ad99859ac90ac6863ad0a6cd075d8e0e upstream. commit 9b5e383c11b08784 (net: Introduce unregister_netdevice_many()) left an active LIST_HEAD() in rollback_registered(), with possible memory corruption. Even if device is freed without touching its unreg_list (and therefore touching the previous memory location holding LISTE_HEAD(single), better close the bug for good, since its really subtle. (Same fix for default_device_exit_batch() for completeness) Reported-by: Michal Hocko <mhocko@suse.cz> Tested-by: Michal Hocko <mhocko@suse.cz> Reported-by: Eric W. Biderman <ebiderman@xmission.com> Tested-by: Eric W. Biderman <ebiderman@xmission.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> CC: Ingo Molnar <mingo@elte.hu> CC: Octavian Purdila <opurdila@ixiacom.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'net/core/dev.c')
-rw-r--r--net/core/dev.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/net/core/dev.c b/net/core/dev.c
index 6d1eefc258a..4d2f613342b 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -4846,6 +4846,7 @@ static void rollback_registered(struct net_device *dev)
list_add(&dev->unreg_list, &single);
rollback_registered_many(&single);
+ list_del(&single);
}
static void __netdev_init_queue_locks_one(struct net_device *dev,
@@ -5828,6 +5829,7 @@ static void __net_exit default_device_exit_batch(struct list_head *net_list)
}
}
unregister_netdevice_many(&dev_kill_list);
+ list_del(&dev_kill_list);
rtnl_unlock();
}