summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorEric Dumazet <edumazet@google.com>2013-02-09 00:10:49 +0400
committerDavid S. Miller <davem@davemloft.net>2013-02-11 05:41:43 +0400
commitf45a5c267da35174e22cec955093a7513dc1623d (patch)
tree1853900d36f56c6683d26ea33d06add8cbe2fea7
parent715448ff52e71ed055f352ffcba1ab8e4455ff99 (diff)
downloadlinux-f45a5c267da35174e22cec955093a7513dc1623d.tar.xz
veth: fix NULL dereference in veth_dellink()
commit d0e2c55e7c940 (veth: avoid a NULL deref in veth_stats_one) added another NULL deref in veth_dellink(). # ip link add name veth1 type veth peer name veth0 # rmmod veth We crash because veth_dellink() is called twice, so we must take care of NULL peer. Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--drivers/net/veth.c11
1 files changed, 6 insertions, 5 deletions
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index e1da42aaf9de..07a4af0aa3dc 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -426,12 +426,13 @@ static void veth_dellink(struct net_device *dev, struct list_head *head)
* not being freed before one RCU grace period.
*/
RCU_INIT_POINTER(priv->peer, NULL);
-
- priv = netdev_priv(peer);
- RCU_INIT_POINTER(priv->peer, NULL);
-
unregister_netdevice_queue(dev, head);
- unregister_netdevice_queue(peer, head);
+
+ if (peer) {
+ priv = netdev_priv(peer);
+ RCU_INIT_POINTER(priv->peer, NULL);
+ unregister_netdevice_queue(peer, head);
+ }
}
static const struct nla_policy veth_policy[VETH_INFO_MAX + 1] = {