bridge: Fix double-free in br_add_if.

There is a potential double-kfree in net/bridge/br_if.c. If br_fdb_insert fails, then the kobject is put back (which calls kfree due to the kobject release), and then kfree is called again on the net_bridge_port. This patch fixes the crash. Thanks to Stephen Hemminger for the one-line fix. Signed-off-by: Jeff Hansen <[email protected]> Signed-off-by: David S. Miller <[email protected]>
mrcsosa · Sep 28, 2009 · 30df94f · 30df94f
1 parent 8823ad3
commit 30df94f
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
@@ -432,6 +432,7 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
 	br_fdb_delete_by_port(br, p, 1);
 err1:
 	kobject_put(&p->kobj);
+	p = NULL; /* kobject_put frees */
 err0:
 	dev_set_promiscuity(dev, -1);
 put_back: