lkml.org 
[lkml]   [2013]   [Oct]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.8 24/81] tuntap: correctly handle error in tun_set_iff()
    Date
    3.8.13.12 -stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Jason Wang <jasowang@redhat.com>

    commit 662ca437e714caaab855b12415d6ffd815985bc0 upstream.

    Commit c8d68e6be1c3b242f1c598595830890b65cea64a
    (tuntap: multiqueue support) only call free_netdev() on error in
    tun_set_iff(). This causes several issues:

    - memory of tun security were leaked
    - use after free since the flow gc timer was not deleted and the tfile
    were not detached

    This patch solves the above issues.

    Reported-by: Wannes Rombouts <wannes.rombouts@epitech.eu>
    Cc: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: Jason Wang <jasowang@redhat.com>
    Acked-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    [ kamal: 3.8-stable for CVE-2013-4343 ]
    Cc: Luis Henriques <luis.henriques@canonical.com>
    Signed-off-by: Kamal Mostafa <kamal@canonical.com>
    ---
    drivers/net/tun.c | 11 ++++++++---
    1 file changed, 8 insertions(+), 3 deletions(-)

    diff --git a/drivers/net/tun.c b/drivers/net/tun.c
    index 441c987..66b4613 100644
    --- a/drivers/net/tun.c
    +++ b/drivers/net/tun.c
    @@ -1686,11 +1686,11 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
    INIT_LIST_HEAD(&tun->disabled);
    err = tun_attach(tun, file);
    if (err < 0)
    - goto err_free_dev;
    + goto err_free_flow;

    err = register_netdevice(tun->dev);
    if (err < 0)
    - goto err_free_dev;
    + goto err_detach;

    if (device_create_file(&tun->dev->dev, &dev_attr_tun_flags) ||
    device_create_file(&tun->dev->dev, &dev_attr_owner) ||
    @@ -1734,7 +1734,12 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
    strcpy(ifr->ifr_name, tun->dev->name);
    return 0;

    - err_free_dev:
    +err_detach:
    + tun_detach_all(dev);
    +err_free_flow:
    + tun_flow_uninit(tun);
    + security_tun_dev_free_security(tun->security);
    +err_free_dev:
    free_netdev(dev);
    return err;
    }
    --
    1.8.1.2


    \
     
     \ /
      Last update: 2013-10-29 22:21    [W:4.325 / U:0.128 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site