2.4: [NETLINK] Fix bogus mc_list deletion
Subsystems (2)
Quoted 5 lines · Tim Burress
So not only is the socket dead, it's not even a Netlink socket. Apparently a socket originally allocated to Netlink was not unlinked from the
mc_listafter it was freed, but offhand I can't see how that could happen.
Thanks for tracking this issue down.
Looks like I made a nasty typo in the 2.4 backport. When entries are unlinked from mc_list, we link the list up with the regular hash bucket list by using next instead of bind_next!
Signed-off-by Herbert Xu <[email protected]>
Marcelo, you'll want this to be in the next rc.
Cheers,
Signature · 4 lines
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt===== net/netlink/af_netlink.c 1.21 vs edited =====
net/netlink/af_netlink.c +2 -2
@@ -340,9 +340,9 @@ }if (!nlk_sk (sk)->groups) goto out; -for (skp = &table->mc_list; *skp; skp = &((*skp)->next)) { +for (skp = &table->mc_list; *skp; skp = &((*skp)->bind_next)) {if (*skp == sk) { - *skp = sk->next; + *skp = sk->bind_next;break ; } }