bridge: fix use-after-free in br_cleanup_bridges()

[linux-2.6-omap-h63xx.git] / net / bridge / br_if.c

diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index c2397f503b0f94e850d7da40b68e53fb16b9f9ae..f38cc5317b888bd45f271ed7db5a0f065ada9803 100644 (file)
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -442,12 +442,16 @@ int br_del_if(struct net_bridge *br, struct net_device *dev)
 
 void __exit br_cleanup_bridges(void)
 {
-       struct net_device *dev, *nxt;
+       struct net_device *dev;
 
        rtnl_lock();
-       for_each_netdev_safe(&init_net, dev, nxt)
-               if (dev->priv_flags & IFF_EBRIDGE)
+restart:
+       for_each_netdev(&init_net, dev) {
+               if (dev->priv_flags & IFF_EBRIDGE) {
                        del_br(dev->priv);
+                       goto restart;
+               }
+       }
        rtnl_unlock();
 
 }