summaryrefslogtreecommitdiff
path: root/net/ipv6/seg6.c
diff options
context:
space:
mode:
authorMichelleJin <shjy180909@gmail.com>2021-10-02 22:33:32 +0000
committerDavid S. Miller <davem@davemloft.net>2021-10-04 13:40:19 +0100
commit23b08260481ca552180130bbef0f3a60df4c092e (patch)
tree302f93cb80d0f8e9e6d7fd9355f32ca6bd66aeac /net/ipv6/seg6.c
parente4addd4ed9b91e75fe0f58eecb0d24c60f357d1f (diff)
net: ipv6: fix use after free of struct seg6_pernet_data
sdata->tun_src should be freed before sdata is freed because sdata->tun_src is allocated after sdata allocation. So, kfree(sdata) and kfree(rcu_dereference_raw(sdata->tun_src)) are changed code order. Fixes: f04ed7d277e8 ("net: ipv6: check return value of rhashtable_init") Signed-off-by: MichelleJin <shjy180909@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv6/seg6.c')
-rw-r--r--net/ipv6/seg6.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c
index 65744f2d38da..5daa1c3ed83b 100644
--- a/net/ipv6/seg6.c
+++ b/net/ipv6/seg6.c
@@ -375,8 +375,8 @@ static int __net_init seg6_net_init(struct net *net)
#ifdef CONFIG_IPV6_SEG6_HMAC
if (seg6_hmac_net_init(net)) {
- kfree(sdata);
kfree(rcu_dereference_raw(sdata->tun_src));
+ kfree(sdata);
return -ENOMEM;
};
#endif