Unverified Commit 1afd05e2 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!15837 CVE-2025-21858 

Merge Pull Request from: @ci-robot 
 
PR sync from: Zhang Changzhong <zhangchangzhong@huawei.com>
https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/R3OG4DBKAVIUJH3YVY2HGVR3DNB4BM2L/ 
Kuniyuki Iwashima (2):
  geneve: Fix use-after-free in geneve_find_dev().
  geneve: Suppress list corruption splat in geneve_destroy_tunnels().

 
https://gitee.com/src-openeuler/kernel/issues/IBSVZF 
 
Link:https://gitee.com/openeuler/kernel/pulls/15837

 

Reviewed-by: default avatarLi Nan <linan122@huawei.com>
Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarLi Nan <linan122@huawei.com>
parents 8cf05d37 219b2730

drivers/net/geneve.c

+2 −14
Original line number Diff line number Diff line
@@ -1920,21 +1920,9 @@ static void geneve_destroy_tunnels(struct net *net, struct list_head *head) 
{

	struct geneve_net *gn = net_generic(net, geneve_net_id);

	struct geneve_dev *geneve, *next;

	struct net_device *dev, *aux;



	/* gather any geneve devices that were moved into this ns */

	for_each_netdev_safe(net, dev, aux)

		if (dev->rtnl_link_ops == &geneve_link_ops)

			unregister_netdevice_queue(dev, head);



	/* now gather any other geneve devices that were created in this ns */

	list_for_each_entry_safe(geneve, next, &gn->geneve_list, next) {

		/* If geneve->dev is in the same netns, it was already added

		 * to the list by the previous loop.

		 */

		if (!net_eq(dev_net(geneve->dev), net))

			unregister_netdevice_queue(geneve->dev, head);

	}

	list_for_each_entry_safe(geneve, next, &gn->geneve_list, next)

		geneve_dellink(geneve->dev, head);

}



static void __net_exit geneve_exit_batch_net(struct list_head *net_list)