Don't oops on deldp, by avoiding use-after-free on net_bridge_port.

diff --git a/datapath/datapath.c b/datapath/datapath.c
index adc698065ea873a1a9e4e03e669824421c128235..ed9c557c6381f4c3b97f289ff36b1965c8eac664 100644 (file)
--- a/datapath/datapath.c
+++ b/datapath/datapath.c
@@ -406,12 +406,12 @@ static int del_switch_port(struct net_bridge_port *p)
 /* Called with dp_mutex. */
 static void del_dp(struct datapath *dp)
 {
-       struct net_bridge_port *p;
+       struct net_bridge_port *p, *n;
 
        kthread_stop(dp->dp_task);
 
        /* Drop references to DP. */
-       list_for_each_entry_rcu (p, &dp->port_list, node)
+       list_for_each_entry_safe (p, n, &dp->port_list, node)
                del_switch_port(p);
        rcu_assign_pointer(dps[dp->dp_idx], NULL);