Messages in this thread | | | Date | Mon, 13 Dec 2021 18:11:31 -0800 | From | Jakub Kicinski <> | Subject | Re: [PATCH v2] tun: avoid double free in tun_free_netdev |
| |
On Mon, 13 Dec 2021 12:04:11 -0500 George Kennedy wrote: > Avoid double free in tun_free_netdev() by checking if > dev->reg_state is NETREG_UNREGISTERING in the tun_set_iff() > error paths. If dev->reg_state is NETREG_UNREGISTERING that means > the destructor will be called later. > > BUG: KASAN: double-free or invalid-free in selinux_tun_dev_free_security+0x1a/0x20 security/selinux/hooks.c:5605
> > Reported-by: syzkaller <syzkaller@googlegroups.com> > Signed-off-by: George Kennedy <george.kennedy@oracle.com> > --- > Jakub, decided to go the less code churn route and just > check for dev->reg_state is NETREG_UNREGISTERING.
I don't think this is correct. E.g. if NETDEV_POST_INIT notifier fails the destructor will already have been called and reg_state will be NETREG_UNINITIALIZED which is != NETREG_UNREGISTERING.
What I had in mind is replacing if (!dev->tstats) goto .. with if (reg_state == NETREG_UNREGISTERING) goto ..
But as proven partial destruction on failure of register_netdevice() is extra tricky, I believe moving the code into ndo_init would be less error-prone even if higher LoC delta. Unless there's some trickery in the code move as well, I haven't investigated.
| |