[NET]: rtnl_link: fix use-after-free

[safe/jmp/linux-2.6] / net / core / rtnetlink.c

diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 4a2640d..fed95a3 100644 (file)
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -308,9 +308,12 @@ void __rtnl_link_unregister(struct rtnl_link_ops *ops)
        struct net *net;
 
        for_each_net(net) {
+restart:
                for_each_netdev_safe(net, dev, n) {
-                       if (dev->rtnl_link_ops == ops)
+                       if (dev->rtnl_link_ops == ops) {
                                ops->dellink(dev);
+                               goto restart;
+                       }
                }
        }
        list_del(&ops->list);
@@ -742,7 +745,7 @@ static struct net *get_net_ns_by_pid(pid_t pid)
        /* Lookup the network namespace */
        net = ERR_PTR(-ESRCH);
        rcu_read_lock();
-       tsk = find_task_by_pid(pid);
+       tsk = find_task_by_vpid(pid);
        if (tsk) {
                struct nsproxy *nsproxy;
                nsproxy = task_nsproxy(tsk);