Commit 23b08260 authored by MichelleJin's avatar MichelleJin Committed by David S. Miller
Browse files

net: ipv6: fix use after free of struct seg6_pernet_data 



sdata->tun_src should be freed before sdata is freed
because sdata->tun_src is allocated after sdata allocation.
So, kfree(sdata) and kfree(rcu_dereference_raw(sdata->tun_src)) are
changed code order.

Fixes: f04ed7d2 ("net: ipv6: check return value of rhashtable_init")

Signed-off-by: default avatarMichelleJin <shjy180909@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent e4addd4e

net/ipv6/seg6.c

+1 −1
Original line number Diff line number Diff line
@@ -375,8 +375,8 @@ static int __net_init seg6_net_init(struct net *net) 


#ifdef CONFIG_IPV6_SEG6_HMAC

	if (seg6_hmac_net_init(net)) {

		kfree(sdata);

		kfree(rcu_dereference_raw(sdata->tun_src));

		kfree(sdata);

		return -ENOMEM;

	};

#endif