diff options
| author | Nicolas Dichtel <nicolas.dichtel@6wind.com> | 2014-01-31 09:24:05 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2014-02-06 11:08:17 -0800 |
| commit | 89ed31c6efdd50164b7731296d0a14649e1df79c (patch) | |
| tree | bff03004eff1b5f4322aa89d398a8234fb8c7370 | |
| parent | 1b2a58ff62aa3acc7c539b325972c9b94ce89c3d (diff) | |
Revert "ip6tnl: fix use after free of fb_tnl_dev"
[ No relevant upstream commit. ]
This reverts commit 22c3ec552c29cf4bd4a75566088950fe57d860c4.
This patch is not the right fix, it introduces a memory leak when a netns is
destroyed (the FB device is never deleted).
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Reported-by: Steven Rostedt <srostedt@redhat.com>
Tested-by: Steven Rostedt <srostedt@redhat.com> (and our entire MRG team)
Tested-by: "Luis Claudio R. Goncalves" <lgoncalv@redhat.com>
Tested-by: John Kacur <jkacur@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | net/ipv6/ip6_tunnel.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c index 209bb4d6e188..0516ebbea80b 100644 --- a/net/ipv6/ip6_tunnel.c +++ b/net/ipv6/ip6_tunnel.c @@ -1711,6 +1711,8 @@ static void __net_exit ip6_tnl_destroy_tunnels(struct ip6_tnl_net *ip6n) } } + t = rtnl_dereference(ip6n->tnls_wc[0]); + unregister_netdevice_queue(t->dev, &list); unregister_netdevice_many(&list); } |