lkml.org 
[lkml]   [2021]   [Jun]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.4 15/26] net: caif: fix memory leak in ldisc_open
    Date
    From: Pavel Skripkin <paskripkin@gmail.com>

    [ Upstream commit 58af3d3d54e87bfc1f936e16c04ade3369d34011 ]

    Syzbot reported memory leak in tty_init_dev().
    The problem was in unputted tty in ldisc_open()

    static int ldisc_open(struct tty_struct *tty)
    {
    ...
    ser->tty = tty_kref_get(tty);
    ...
    result = register_netdevice(dev);
    if (result) {
    rtnl_unlock();
    free_netdev(dev);
    return -ENODEV;
    }
    ...
    }

    Ser pointer is netdev private_data, so after free_netdev()
    this pointer goes away with unputted tty reference. So, fix
    it by adding tty_kref_put() before freeing netdev.

    Reported-and-tested-by: syzbot+f303e045423e617d2cad@syzkaller.appspotmail.com
    Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/caif/caif_serial.c | 1 +
    1 file changed, 1 insertion(+)

    diff --git a/drivers/net/caif/caif_serial.c b/drivers/net/caif/caif_serial.c
    index 0f2bee59a82b..0bc7f6518fb3 100644
    --- a/drivers/net/caif/caif_serial.c
    +++ b/drivers/net/caif/caif_serial.c
    @@ -351,6 +351,7 @@ static int ldisc_open(struct tty_struct *tty)
    rtnl_lock();
    result = register_netdevice(dev);
    if (result) {
    + tty_kref_put(tty);
    rtnl_unlock();
    free_netdev(dev);
    return -ENODEV;
    --
    2.30.2
    \
     
     \ /
      Last update: 2021-06-21 20:00    [W:3.774 / U:0.080 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site