diff options
| author | Eric Dumazet <[email protected]> | 2010-06-06 23:48:40 +0000 |
|---|---|---|
| committer | David S. Miller <[email protected]> | 2010-06-07 09:57:14 +0000 |
| commit | 035320d54758e21227987e3aae0d46e7a04f4ddc (patch) | |
| tree | 9ad66a45ab0b0d903ebcbe435894d1fb9d5d78f5 /fs/jbd/commit.c | |
| parent | 8139too: fix buffer overrun in rtl8139_init_board (diff) | |
| download | kernel-035320d54758e21227987e3aae0d46e7a04f4ddc.tar.gz kernel-035320d54758e21227987e3aae0d46e7a04f4ddc.zip | |
ipmr: dont corrupt lists
ipmr_rules_exit() and ip6mr_rules_exit() free a list of items, but
forget to properly remove these items from list. List head is not
changed and still points to freed memory.
This can trigger a fault later when icmpv6_sk_exit() is called.
Fix is to either reinit list, or use list_del() to properly remove items
from list before freeing them.
bugzilla report : https://bugzilla.kernel.org/show_bug.cgi?id=16120
Introduced by commit d1db275dd3f6e4 (ipv6: ip6mr: support multiple
tables) and commit f0ad0860d01e (ipv4: ipmr: support multiple tables)
Reported-by: Alex Zhavnerchik <[email protected]>
Signed-off-by: Eric Dumazet <[email protected]>
CC: Patrick McHardy <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Diffstat (limited to 'fs/jbd/commit.c')
0 files changed, 0 insertions, 0 deletions