mirror of
https://github.com/torvalds/linux.git
synced 2026-07-27 01:32:21 +02:00
2e996ca81f
The ethtool debugfs files point directly into struct netdevsim, which is
allocated as net_device private data. Their containing port directory is
removed only after nsim_destroy() calls free_netdev().
An open simple-attribute file can consequently dereference the freed
private data before the directory is removed. KASAN observed this in
debugfs_u32_get() during network namespace teardown.
Track and remove the ethtool subtree before free_netdev() on both the
normal and registration-failure paths. debugfs removal drains active
file users before returning.
Fixes:
|
||
|---|---|---|
| .. | ||
| bpf.c | ||
| bus.c | ||
| dev.c | ||
| ethtool.c | ||
| fib.c | ||
| health.c | ||
| hwstats.c | ||
| ipsec.c | ||
| macsec.c | ||
| Makefile | ||
| netdev.c | ||
| netdevsim.h | ||
| psample.c | ||
| psp.c | ||
| tc.c | ||
| udp_tunnels.c | ||