Commit aaa53c4a authored by Benjamin Thery's avatar Benjamin Thery Committed by David S. Miller
Browse files

[NET]: Fix crash in dev_mc_sync()/dev_mc_unsync()



This patch fixes a crash that may occur when the routine dev_mc_sync()
deletes an address from the list it is currently going through. It
saves the pointer to the next element before deleting the current one.
The problem may also exist in dev_mc_unsync().
Signed-off-by: default avatarBenjamin Thery <benjamin.thery@bull.net>
Acked-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent f424bb9e
...@@ -116,11 +116,13 @@ int dev_mc_add(struct net_device *dev, void *addr, int alen, int glbl) ...@@ -116,11 +116,13 @@ int dev_mc_add(struct net_device *dev, void *addr, int alen, int glbl)
*/ */
int dev_mc_sync(struct net_device *to, struct net_device *from) int dev_mc_sync(struct net_device *to, struct net_device *from)
{ {
struct dev_addr_list *da; struct dev_addr_list *da, *next;
int err = 0; int err = 0;
netif_tx_lock_bh(to); netif_tx_lock_bh(to);
for (da = from->mc_list; da != NULL; da = da->next) { da = from->mc_list;
while (da != NULL) {
next = da->next;
if (!da->da_synced) { if (!da->da_synced) {
err = __dev_addr_add(&to->mc_list, &to->mc_count, err = __dev_addr_add(&to->mc_list, &to->mc_count,
da->da_addr, da->da_addrlen, 0); da->da_addr, da->da_addrlen, 0);
...@@ -134,6 +136,7 @@ int dev_mc_sync(struct net_device *to, struct net_device *from) ...@@ -134,6 +136,7 @@ int dev_mc_sync(struct net_device *to, struct net_device *from)
__dev_addr_delete(&from->mc_list, &from->mc_count, __dev_addr_delete(&from->mc_list, &from->mc_count,
da->da_addr, da->da_addrlen, 0); da->da_addr, da->da_addrlen, 0);
} }
da = next;
} }
if (!err) if (!err)
__dev_set_rx_mode(to); __dev_set_rx_mode(to);
...@@ -156,12 +159,14 @@ EXPORT_SYMBOL(dev_mc_sync); ...@@ -156,12 +159,14 @@ EXPORT_SYMBOL(dev_mc_sync);
*/ */
void dev_mc_unsync(struct net_device *to, struct net_device *from) void dev_mc_unsync(struct net_device *to, struct net_device *from)
{ {
struct dev_addr_list *da; struct dev_addr_list *da, *next;
netif_tx_lock_bh(from); netif_tx_lock_bh(from);
netif_tx_lock_bh(to); netif_tx_lock_bh(to);
for (da = from->mc_list; da != NULL; da = da->next) { da = from->mc_list;
while (da != NULL) {
next = da->next;
if (!da->da_synced) if (!da->da_synced)
continue; continue;
__dev_addr_delete(&to->mc_list, &to->mc_count, __dev_addr_delete(&to->mc_list, &to->mc_count,
...@@ -169,6 +174,7 @@ void dev_mc_unsync(struct net_device *to, struct net_device *from) ...@@ -169,6 +174,7 @@ void dev_mc_unsync(struct net_device *to, struct net_device *from)
da->da_synced = 0; da->da_synced = 0;
__dev_addr_delete(&from->mc_list, &from->mc_count, __dev_addr_delete(&from->mc_list, &from->mc_count,
da->da_addr, da->da_addrlen, 0); da->da_addr, da->da_addrlen, 0);
da = next;
} }
__dev_set_rx_mode(to); __dev_set_rx_mode(to);
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment