When unregistering the rtnl_link_ops, all existing devices using the ops are destroyed. With nested devices this may lead to a use-after-free despite the use of for_each_netdev_safe() in case the upper device is next in the device list and is destroyed by the NETDEV_UNREGISTER notifier. The easy fix is to restart scanning the device list after removing a device. Alternatively we could add new devices to the front of the list to avoid having dependant devices follow the device they depend on. A third option would be to only restart scanning if dev->iflink of the next device matches dev->ifindex of the current one. For now this seems like the safest solution. With this patch, the veth rtnl_link_ops unregistration can use rtnl_link_unregister() directly since it now also handles destruction of multiple devices at once. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net> |
||
---|---|---|
.. | ||
datagram.c | ||
dev.c | ||
dev_mcast.c | ||
dst.c | ||
ethtool.c | ||
fib_rules.c | ||
filter.c | ||
flow.c | ||
gen_estimator.c | ||
gen_stats.c | ||
iovec.c | ||
kmap_skb.h | ||
link_watch.c | ||
Makefile | ||
neighbour.c | ||
net-sysfs.c | ||
net-sysfs.h | ||
net_namespace.c | ||
netevent.c | ||
netpoll.c | ||
pktgen.c | ||
request_sock.c | ||
rtnetlink.c | ||
scm.c | ||
skbuff.c | ||
sock.c | ||
stream.c | ||
sysctl_net_core.c | ||
user_dma.c | ||
utils.c |