bridge: Fix double-free in br_add_if.
There is a potential double-kfree in net/bridge/br_if.c. If br_fdb_insert fails, then the kobject is put back (which calls kfree due to the kobject release), and then kfree is called again on the net_bridge_port. This patch fixes the crash. Thanks to Stephen Hemminger for the one-line fix. Signed-off-by: Jeff Hansen <x@jeffhansen.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
8823ad31cd
commit
30df94f800
|
@ -432,6 +432,7 @@ err2:
|
||||||
br_fdb_delete_by_port(br, p, 1);
|
br_fdb_delete_by_port(br, p, 1);
|
||||||
err1:
|
err1:
|
||||||
kobject_put(&p->kobj);
|
kobject_put(&p->kobj);
|
||||||
|
p = NULL; /* kobject_put frees */
|
||||||
err0:
|
err0:
|
||||||
dev_set_promiscuity(dev, -1);
|
dev_set_promiscuity(dev, -1);
|
||||||
put_back:
|
put_back:
|
||||||
|
|
Loading…
Reference in New Issue