lkml.org 
[lkml]   [2021]   [Dec]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH v2] tun: avoid double free in tun_free_netdev
On Mon, 13 Dec 2021 12:04:11 -0500 George Kennedy wrote:
> Avoid double free in tun_free_netdev() by checking if
> dev->reg_state is NETREG_UNREGISTERING in the tun_set_iff()
> error paths. If dev->reg_state is NETREG_UNREGISTERING that means
> the destructor will be called later.
>
> BUG: KASAN: double-free or invalid-free in selinux_tun_dev_free_security+0x1a/0x20 security/selinux/hooks.c:5605

>
> Reported-by: syzkaller <syzkaller@googlegroups.com>
> Signed-off-by: George Kennedy <george.kennedy@oracle.com>
> ---
> Jakub, decided to go the less code churn route and just
> check for dev->reg_state is NETREG_UNREGISTERING.

I don't think this is correct. E.g. if NETDEV_POST_INIT notifier
fails the destructor will already have been called and reg_state
will be NETREG_UNINITIALIZED which is != NETREG_UNREGISTERING.

What I had in mind is replacing if (!dev->tstats) goto .. with
if (reg_state == NETREG_UNREGISTERING) goto ..

But as proven partial destruction on failure of register_netdevice() is
extra tricky, I believe moving the code into ndo_init would be less
error-prone even if higher LoC delta. Unless there's some trickery in
the code move as well, I haven't investigated.

\
 
 \ /
  Last update: 2021-12-14 03:12    [W:0.068 / U:0.036 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site