]> git.proxmox.com Git - mirror_ubuntu-artful-kernel.git/commit
vxlan: fix use-after-free on deletion
authorMark Bloch <markb@mellanox.com>
Fri, 2 Jun 2017 00:24:08 +0000 (03:24 +0300)
committerThadeu Lima de Souza Cascardo <cascardo@canonical.com>
Tue, 27 Jun 2017 13:16:21 +0000 (10:16 -0300)
commit2932ddee60a0105d0b8ce621ece76f20dce844dc
tree1201151ce31fe2e3fc90bea559b5c29d213bcaa4
parenteff4a7dfd7cb3c635e9432485243a48c23236a3d
vxlan: fix use-after-free on deletion

BugLink: http://bugs.launchpad.net/bugs/1698799
[ Upstream commit a53cb29b0af346af44e4abf13d7e59f807fba690 ]

Adding a vxlan interface to a socket isn't symmetrical, while adding
is done in vxlan_open() the deletion is done in vxlan_dellink().
This can cause a use-after-free error when we close the vxlan
interface before deleting it.

We add vxlan_vs_del_dev() to match vxlan_vs_add_dev() and call
it from vxlan_stop() to match the call from vxlan_open().

Fixes: 56ef9c909b40 ("vxlan: Move socket initialization to within rtnl scope")
Acked-by: Jiri Benc <jbenc@redhat.com>
Tested-by: Roi Dayan <roid@mellanox.com>
Signed-off-by: Mark Bloch <markb@mellanox.com>
Acked-by: Roopa Prabhu <roopa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
drivers/net/vxlan.c