From: Stephen Hemminger <shemminger@xxxxxxxxxx> Date: Wed, 2 Jul 2008 09:48:17 -0700 > On Wed, 02 Jul 2008 15:04:14 +0200 > Patrick McHardy <kaber@xxxxxxxxx> wrote: > > > commit 96f1dd78dad10d61bdd487edadea6adda5425e4c > > Author: Patrick McHardy <kaber@xxxxxxxxx> > > Date: Wed Jul 2 15:02:23 2008 +0200 > > > > bridge: fix use-after-free in br_cleanup_bridges() > > > > Unregistering a bridge device may cause virtual devices stacked on the > > bridge, like vlan or macvlan devices, to be unregistered as well. > > br_cleanup_bridges() uses for_each_netdev_safe() to iterate over all > > devices during cleanup. This is not enough however, if one of the > > additionally unregistered devices is next in the list to the bridge > > device, it will get freed as well and the iteration continues on > > the freed element. > > > > Restart iteration after each bridge device removal from the beginning to > > fix this, similar to what rtnl_link_unregister() does. > > > > Signed-off-by: Patrick McHardy <kaber@xxxxxxxxx> > > Acked-by: Stephen Hemminger <shemminger@xxxxxxxxxx> Applied, thanks everyone. _______________________________________________ Bridge mailing list Bridge@xxxxxxxxxxxxxxxxxxxxxxxxxx https://lists.linux-foundation.org/mailman/listinfo/bridge
