Commit 6b863d1d authored Nov 17, 2009 by Eric Dumazet Committed by David S. Miller Nov 17, 2009

vlan: Fix register_vlan_dev() error path



In case register_netdevice() returns an error, and a new vlan_group
was allocated and inserted in vlan_group_hash[] we call
vlan_group_free() without deleting group from hash table. Future
lookups can give infinite loops or crashes.

We must delete the vlan_group using RCU safe procedure.

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 69c0cab1

net/8021q/vlan.c

+5 −2

Original line number	Diff line number	Diff line
		@@ -281,8 +281,11 @@ out_uninit_applicant:
		if (ngrp)
		vlan_gvrp_uninit_applicant(real_dev);
		out_free_group:
		if (ngrp)
		vlan_group_free(ngrp);
		if (ngrp) {
		hlist_del_rcu(&ngrp->hlist);
		/* Free the group, after all cpu's are done. */
		call_rcu(&ngrp->rcu, vlan_rcu_free);
		}
		return err;
		}

Admin message