summaryrefslogtreecommitdiff
path: root/net/dsa
diff options
context:
space:
mode:
authorFlorian Fainelli <f.fainelli@gmail.com>2019-11-02 20:13:26 -0700
committerDavid S. Miller <davem@davemloft.net>2019-11-05 17:53:58 -0800
commitc058f6dfeb1c645e77dc89d1690848ca06f45735 (patch)
treea3da3bf333e70412ca42f2bcc1fb58318cc8e2af /net/dsa
parent2bceefbe557f4b4e875ca6db19a9f8a8bb3d557d (diff)
net: dsa: Fix use after free in dsa_switch_remove()
The order in which the ports are deleted from the list and freed and the call to dsa_switch_remove() is done is reversed, which leads to an use after free condition. Reverse the two: first tear down the ports and switch from the fabric, then free the ports associated with that switch fabric. Fixes: 05f294a85235 ("net: dsa: allocate ports on touch") Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> Reviewed-by: Vivien Didelot <vivien.didelot@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/dsa')
-rw-r--r--net/dsa/dsa2.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/net/dsa/dsa2.c b/net/dsa/dsa2.c
index ff2fa3950c62..9ef2caa13f27 100644
--- a/net/dsa/dsa2.c
+++ b/net/dsa/dsa2.c
@@ -874,12 +874,13 @@ static void dsa_switch_remove(struct dsa_switch *ds)
struct dsa_switch_tree *dst = ds->dst;
struct dsa_port *dp, *next;
+ dsa_tree_teardown(dst);
+
list_for_each_entry_safe(dp, next, &dst->ports, list) {
list_del(&dp->list);
kfree(dp);
}
- dsa_tree_teardown(dst);
dsa_tree_put(dst);
}