Commit:     3201e656ce56ed02e9501906c18ffe16ae350a52
Parent:     3a2c892daaf54b31a70785c2821771e8094188ed
Author:     Jay Vosburgh <[EMAIL PROTECTED]>
AuthorDate: Tue Jun 19 11:12:12 2007 -0700
Committer:  Jeff Garzik <[EMAIL PROTECTED]>
CommitDate: Wed Jun 20 19:12:41 2007 -0400

    bonding: Fix use after free in unregister path
        The following patch (based on a patch from Stephen Hemminger
    <[EMAIL PROTECTED]>) removes use after free conditions in
    the unregister path for the bonding master.  Without this patch, an
    operation of the form "echo -bond0 > /sys/class/net/bonding_masters"
    would trigger a NULL pointer dereference in sysfs.  I was not able to
    induce the failure with the non-sysfs code path, but for consistency I
    updated that code as well.
        I also did some testing of the bonding /proc file being open
    while the bond is being deleted, and didn't see any problems there.
    Signed-off-by: Jay Vosburgh <[EMAIL PROTECTED]>
    Signed-off-by: Jeff Garzik <[EMAIL PROTECTED]>
 drivers/net/bonding/bond_main.c  |    2 +-
 drivers/net/bonding/bond_sysfs.c |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 223517d..6287ffb 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -4345,8 +4345,8 @@ static void bond_free_all(void)
                /* Release the bonded slaves */
-               unregister_netdevice(bond_dev);
+               unregister_netdevice(bond_dev);
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index a122baa..60cccf2 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -164,9 +164,9 @@ static ssize_t bonding_store_bonds(struct class *cls, const 
char *buffer, size_t
                                printk(KERN_INFO DRV_NAME
                                        ": %s is being deleted...\n",
-                               unregister_netdevice(bond->dev);
+                               unregister_netdevice(bond->dev);
                                goto out;
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at

Reply via email to