Le 11/12/2013 22:53, David Miller a écrit :
From: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
Date: Sun, 8 Dec 2013 16:25:31 -0800
On Wed, Nov 13, 2013 at 09:14:30PM -0500, Steven Rostedt wrote:
+++ b/net/ipv6/ip6_tunnel.c
@@ -1731,8 +1731,6 @@ static void __net_exit ip6_tnl_destroy_tunnels(struct ip
}
}
- t = rtnl_dereference(ip6n->tnls_wc[0]);
- unregister_netdevice_queue(t->dev, &list);
unregister_netdevice_many(&list);
}
Which, when applied to 3.10.18, fixes the bug. Was there a reason that
this part of the commit wasn't backported? or was this just an oversight?
It looks like it was left out to me as well.
David, any objection to me making this fixup in the 3.10-stable tree?
The original patch submitted told me to leave this part of the patch
out of the backport, explaining that it wasn't necessary in older
kernels.
Yes, and this was right (in upstream commit, I remove this part because
the fb device is deleted by the loop which check dev->rtnl_ops) , but ...
Can someone please sort this out?
Nicolas please provide some guidance here, thanks.
The original patch left a bug, which was fixed upstream with this commit:
1e9f3d6f1c40 ip6tnl: fix use after free of fb_tnl_dev
The problem is a bit different in 3.10.y, because there is no x-vrf support.
When ip6_tunnel.ko is unloaded, FB device is deleted by rtnl_link_unregister()
and then we try to delete it again in ip6_tnl_destroy_tunnels().
Thus the fix is different and in fact, the above patch is good.
Steven, will you submit this patch properly or should I do this?
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html