From patchwork Wed Aug 10 09:44:17 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Uwe_Kleine-K=C3=B6nig?= X-Patchwork-Id: 9273639 X-Patchwork-Delegate: geert@linux-m68k.org Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id B6DA3600CA for ; Wed, 10 Aug 2016 19:03:42 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id A422F283E7 for ; Wed, 10 Aug 2016 19:03:42 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 98B252841E; Wed, 10 Aug 2016 19:03:42 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D7FBA283E7 for ; Wed, 10 Aug 2016 19:03:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S941107AbcHJTCf (ORCPT ); Wed, 10 Aug 2016 15:02:35 -0400 Received: from metis.ext.4.pengutronix.de ([92.198.50.35]:47351 "EHLO metis.ext.4.pengutronix.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S936507AbcHJTC0 (ORCPT ); Wed, 10 Aug 2016 15:02:26 -0400 Received: from dude.hi.pengutronix.de ([2001:67c:670:100:1d::7]) by metis.ext.pengutronix.de with esmtps (TLS1.2:RSA_AES_256_CBC_SHA1:256) (Exim 4.80) (envelope-from ) id 1bXQ3h-0004wn-JQ; Wed, 10 Aug 2016 11:44:21 +0200 Received: from ukl by dude.hi.pengutronix.de with local (Exim 4.87) (envelope-from ) id 1bXQ3f-0003Sx-I9; Wed, 10 Aug 2016 11:44:19 +0200 From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= To: Geert Uytterhoeven , "David S. Miller" Cc: netdev@vger.kernel.org, Linux-Renesas , kernel@pengutronix.de Subject: [PATCH] net: ipconfig: fix use after free Date: Wed, 10 Aug 2016 11:44:17 +0200 Message-Id: <1470822257-13275-1-git-send-email-u.kleine-koenig@pengutronix.de> X-Mailer: git-send-email 2.8.1 In-Reply-To: References: MIME-Version: 1.0 X-SA-Exim-Connect-IP: 2001:67c:670:100:1d::7 X-SA-Exim-Mail-From: ukl@pengutronix.de X-SA-Exim-Scanned: No (on metis.ext.pengutronix.de); SAEximRunCond expanded to false X-PTX-Original-Recipient: linux-renesas-soc@vger.kernel.org Sender: linux-renesas-soc-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-renesas-soc@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP ic_close_devs() calls kfree() for all devices's ic_device. Since commit 2647cffb2bc6 ("net: ipconfig: Support using "delayed" DHCP replies") the active device's ic_device is still used however to print the ipconfig summary which results in an oops if the memory is already changed. So delay freeing until after the autoconfig results are reported. Fixes: 2647cffb2bc6 ("net: ipconfig: Support using "delayed" DHCP replies") Reported-by: Geert Uytterhoeven Signed-off-by: Uwe Kleine-König Tested-by: Geert Uytterhoeven --- net/ipv4/ipconfig.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c index 42cf629357b5..66c2fe602810 100644 --- a/net/ipv4/ipconfig.c +++ b/net/ipv4/ipconfig.c @@ -1493,14 +1493,6 @@ static int __init ip_auto_config(void) return -1; /* - * Close all network devices except the device we've - * autoconfigured and set up routes. - */ - ic_close_devs(); - if (ic_setup_if() < 0 || ic_setup_routes() < 0) - return -1; - - /* * Record which protocol was actually used. */ #ifdef IPCONFIG_DYNAMIC @@ -1534,6 +1526,15 @@ static int __init ip_auto_config(void) pr_cont("\n"); #endif /* !SILENT */ + /* + * Close all network devices except the device we've + * autoconfigured and set up routes. + */ + ic_close_devs(); + if (ic_setup_if() < 0 || ic_setup_routes() < 0) + return -1; + + return 0; }