diff options
| author | Herbert Xu <[email protected]> | 2015-03-15 10:12:04 +0000 |
|---|---|---|
| committer | David S. Miller <[email protected]> | 2015-03-16 02:22:08 +0000 |
| commit | 963ecbd41a1026d99ec7537c050867428c397b89 (patch) | |
| tree | b1735fd0d424222d31fb72f51d860b51e417dac5 /net/switchdev/switchdev.c | |
| parent | net: bcmgenet: add support for Hardware Filter Block (diff) | |
| download | kernel-963ecbd41a1026d99ec7537c050867428c397b89.tar.gz kernel-963ecbd41a1026d99ec7537c050867428c397b89.zip | |
rhashtable: Fix use-after-free in rhashtable_walk_stop
The commit c4db8848af6af92f90462258603be844baeab44d ("rhashtable:
Move future_tbl into struct bucket_table") introduced a use-after-
free bug in rhashtable_walk_stop because it dereferences tbl after
droping the RCU read lock.
This patch fixes it by moving the RCU read unlock down to the bottom
of rhashtable_walk_stop. In fact this was how I had it originally
but it got dropped while rearranging patches because this one
depended on the async freeing of bucket_table.
Signed-off-by: Herbert Xu <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Diffstat (limited to 'net/switchdev/switchdev.c')
0 files changed, 0 insertions, 0 deletions