]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/commit
inet: frags: call inet_frags_fini() after unregister_pernet_subsys()
authorEric Dumazet <edumazet@google.com>
Mon, 27 May 2019 23:56:48 +0000 (16:56 -0700)
committerKhalid Elmously <khalid.elmously@canonical.com>
Fri, 14 Feb 2020 05:29:37 +0000 (00:29 -0500)
commit266ba151677921f2b165644feabc66caa91dd080
tree323144fecf377d4676858dc9057e17371100c864
parenta737f34d44997ec1554e6a745e0412d91dab6819
inet: frags: call inet_frags_fini() after unregister_pernet_subsys()

BugLink: https://bugs.launchpad.net/bugs/1863019
[ Upstream commit ae7352d384a552d8c799c242e74a934809990a71 ]

Both IPv6 and 6lowpan are calling inet_frags_fini() too soon.

inet_frags_fini() is dismantling a kmem_cache, that might be needed
later when unregister_pernet_subsys() eventually has to remove
frags queues from hash tables and free them.

This fixes potential use-after-free, and is a prereq for the following patch.

Fixes: d4ad4d22e7ac ("inet: frags: use kmem_cache for inet_frag_queue")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>
net/ieee802154/6lowpan/reassembly.c
net/ipv6/reassembly.c