inet: frags: call inet_frags_fini() after unregister_pernet_subsys()

BugLink: https://bugs.launchpad.net/bugs/1863019
[ Upstream commit ae7352d384a552d8c799c242e74a934809990a71 ]

Both IPv6 and 6lowpan are calling inet_frags_fini() too soon.

inet_frags_fini() is dismantling a kmem_cache, that might be needed
later when unregister_pernet_subsys() eventually has to remove
frags queues from hash tables and free them.

This fixes potential use-after-free, and is a prereq for the following patch.

Fixes: d4ad4d22e7ac ("inet: frags: use kmem_cache for inet_frag_queue")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>

diff --git a/net/ieee802154/6lowpan/reassembly.c b/net/ieee802154/6lowpan/reassembly.c
index ec7a5da561290ac92c234338d306fb300e46e62c..e873a6a007f2a51ed7e3da4cc1abebfa4c98c104 100644 (file)
--- a/net/ieee802154/6lowpan/reassembly.c
+++ b/net/ieee802154/6lowpan/reassembly.c
@@ -634,7 +634,7 @@ err_sysctl:
 
 void lowpan_net_frag_exit(void)
 {
-       inet_frags_fini(&lowpan_frags);
        lowpan_frags_sysctl_unregister();
        unregister_pernet_subsys(&lowpan_frags_ops);
+       inet_frags_fini(&lowpan_frags);
 }

diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index fe797b29ca89d802058735eb51fa2769e2976597..6dea6e92e686342a50c2fdb651923853463fb0d6 100644 (file)
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -593,8 +593,8 @@ err_protocol:
 
 void ipv6_frag_exit(void)
 {
-       inet_frags_fini(&ip6_frags);
        ip6_frags_sysctl_unregister();
        unregister_pernet_subsys(&ip6_frags_ops);
        inet6_del_protocol(&frag_protocol, IPPROTO_FRAGMENT);
+       inet_frags_fini(&ip6_frags);
 }