Re: [PATCH net] net: dsa: Fix stale cpu_switch reference after unbind then bind

2017-06-04 Thread David Miller
From: Florian Fainelli Date: Fri, 2 Jun 2017 22:05:23 -0700 > Commit 9520ed8fb841 ("net: dsa: use cpu_switch instead of ds[0]") > replaced the use of dst->ds[0] with dst->cpu_switch since that is > functionally equivalent, however, we can now run into an use after free >

Re: [PATCH net] net: dsa: Fix stale cpu_switch reference after unbind then bind

2017-06-04 Thread David Miller
From: Florian Fainelli Date: Fri, 2 Jun 2017 22:05:23 -0700 > Commit 9520ed8fb841 ("net: dsa: use cpu_switch instead of ds[0]") > replaced the use of dst->ds[0] with dst->cpu_switch since that is > functionally equivalent, however, we can now run into an use after free > scenario after

Re: [PATCH net] net: dsa: Fix stale cpu_switch reference after unbind then bind

2017-06-03 Thread Vivien Didelot
Hi Florian, Florian Fainelli writes: > Commit 9520ed8fb841 ("net: dsa: use cpu_switch instead of ds[0]") > replaced the use of dst->ds[0] with dst->cpu_switch since that is > functionally equivalent, however, we can now run into an use after free > scenario after unbinding

Re: [PATCH net] net: dsa: Fix stale cpu_switch reference after unbind then bind

2017-06-03 Thread Vivien Didelot
Hi Florian, Florian Fainelli writes: > Commit 9520ed8fb841 ("net: dsa: use cpu_switch instead of ds[0]") > replaced the use of dst->ds[0] with dst->cpu_switch since that is > functionally equivalent, however, we can now run into an use after free > scenario after unbinding then rebinding the

[PATCH net] net: dsa: Fix stale cpu_switch reference after unbind then bind

2017-06-02 Thread Florian Fainelli
Commit 9520ed8fb841 ("net: dsa: use cpu_switch instead of ds[0]") replaced the use of dst->ds[0] with dst->cpu_switch since that is functionally equivalent, however, we can now run into an use after free scenario after unbinding then rebinding the switch driver. The use after free happens because

[PATCH net] net: dsa: Fix stale cpu_switch reference after unbind then bind

2017-06-02 Thread Florian Fainelli
Commit 9520ed8fb841 ("net: dsa: use cpu_switch instead of ds[0]") replaced the use of dst->ds[0] with dst->cpu_switch since that is functionally equivalent, however, we can now run into an use after free scenario after unbinding then rebinding the switch driver. The use after free happens because