Unverified Commit ac44c6a4 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!15664 CVE-2025-21858 

Merge Pull Request from: @ci-robot 
 
PR sync from: Zhang Changzhong <zhangchangzhong@huawei.com>
https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/BX47GFP5IQ56M44MNHEURY7VFURQMDM6/ 
Kuniyuki Iwashima (2):
  geneve: Fix use-after-free in geneve_find_dev().
  geneve: Suppress list corruption splat in geneve_destroy_tunnels().

 
https://gitee.com/src-openeuler/kernel/issues/IBSVZF 
 
Link:https://gitee.com/openeuler/kernel/pulls/15664

 

Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Reviewed-by: default avatarLu Jialin <lujialin4@huawei.com>
Reviewed-by: default avatarYuan Can <yuancan@huawei.com>
Signed-off-by: default avatarYuan Can <yuancan@huawei.com>
parents db05731a 65481125

drivers/net/geneve.c

+2 −14
Original line number Diff line number Diff line
@@ -1741,21 +1741,9 @@ static void geneve_destroy_tunnels(struct net *net, struct list_head *head) 
{

	struct geneve_net *gn = net_generic(net, geneve_net_id);

	struct geneve_dev *geneve, *next;

	struct net_device *dev, *aux;



	/* gather any geneve devices that were moved into this ns */

	for_each_netdev_safe(net, dev, aux)

		if (dev->rtnl_link_ops == &geneve_link_ops)

			unregister_netdevice_queue(dev, head);



	/* now gather any other geneve devices that were created in this ns */

	list_for_each_entry_safe(geneve, next, &gn->geneve_list, next) {

		/* If geneve->dev is in the same netns, it was already added

		 * to the list by the previous loop.

		 */

		if (!net_eq(dev_net(geneve->dev), net))

			unregister_netdevice_queue(geneve->dev, head);

	}

	list_for_each_entry_safe(geneve, next, &gn->geneve_list, next)

		geneve_dellink(geneve->dev, head);



	WARN_ON_ONCE(!list_empty(&gn->sock_list));

}