71de0177b2
phonet_device_destroy() removes a phonet_device from the per-net device
list with list_del_rcu(), but frees it immediately. RCU readers walking
the same list can still hold a pointer to the object after it has been
removed, leading to a slab-use-after-free.
Use kfree_rcu(), matching the lifetime rule already used by
phonet_address_del() for the same object type.
Fixes:
|
||
|---|---|---|
| .. | ||
| af_phonet.c | ||
| datagram.c | ||
| Kconfig | ||
| Makefile | ||
| pep-gprs.c | ||
| pep.c | ||
| pn_dev.c | ||
| pn_netlink.c | ||
| socket.c | ||
| sysctl.c | ||