lkml.org 
[lkml]   [2020]   [Jun]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 16/36] slcan: Fix double-free on slcan_open() error path
    Date
    From: Ben Hutchings <ben@decadent.org.uk>

    Commit 9ebd796e2400 ("can: slcan: Fix use-after-free Read in
    slcan_open") was incorrectly backported to 4.4 and 4.9 stable
    branches.

    Since they do not have commit cf124db566e6 ("net: Fix inconsistent
    teardown and release of private netdev state."), the destructor
    function slc_free_netdev() is already responsible for calling
    free_netdev() and slcan_open() must not call both of them.

    yangerkun previously fixed the same bug in slip.

    Fixes: ce624b2089ea ("can: slcan: Fix use-after-free Read in slcan_open") # 4.4
    Fixes: f59604a80fa4 ("slcan: not call free_netdev before rtnl_unlock ...") # 4.4
    Fixes: 56635a1e6ffb ("can: slcan: Fix use-after-free Read in slcan_open") # 4.9
    Fixes: a1c9b23142ac ("slcan: not call free_netdev before rtnl_unlock ...") # 4.9
    Cc: yangerkun <yangerkun@huawei.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/net/can/slcan.c | 3 +--
    1 file changed, 1 insertion(+), 2 deletions(-)

    --- a/drivers/net/can/slcan.c
    +++ b/drivers/net/can/slcan.c
    @@ -618,10 +618,9 @@ err_free_chan:
    sl->tty = NULL;
    tty->disc_data = NULL;
    clear_bit(SLF_INUSE, &sl->flags);
    - slc_free_netdev(sl->dev);
    /* do not call free_netdev before rtnl_unlock */
    rtnl_unlock();
    - free_netdev(sl->dev);
    + slc_free_netdev(sl->dev);
    return err;

    err_exit:

    \
     
     \ /
      Last update: 2020-06-09 20:24    [W:4.015 / U:0.076 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site