Re: [PATCH net] ip6tnl: fix use after free of fb_tnl_dev

2013-11-14 Thread Steven Rostedt
On Thu, 14 Nov 2013 17:05:29 -0500 (EST) David Miller wrote: > Applied and queued up for -stable, thanks for being so proactive about this > Nicolas. I should also note that I added this back to 3.10.18 and the bug goes away. If it's not too late: Tested-by: Steven Rostedt -- Steve -- To

Re: [PATCH net] ip6tnl: fix use after free of fb_tnl_dev

2013-11-14 Thread David Miller
From: Nicolas Dichtel Date: Thu, 14 Nov 2013 15:47:03 +0100 > Bug has been introduced by commit bb8140947a24 ("ip6tnl: allow to use rtnl ops > on fb tunnel"). > > When ip6_tunnel.ko is unloaded, FB device is delete by rtnl_link_unregister() > and then we try to use the pointer in ip6_tnl_destroy

Re: [PATCH net] ip6tnl: fix use after free of fb_tnl_dev

2013-11-14 Thread Willem de Bruijn
On Thu, Nov 14, 2013 at 9:47 AM, Nicolas Dichtel wrote: > Bug has been introduced by commit bb8140947a24 ("ip6tnl: allow to use rtnl ops > on fb tunnel"). > > When ip6_tunnel.ko is unloaded, FB device is delete by rtnl_link_unregister() > and then we try to use the pointer in ip6_tnl_destroy_tunne