Messages in this thread Patch in this message | | | Subject | Re: [PATCH 4.3 34/71] vrf: fix double free and memory corruption on register_netdevice failure | From | David Ahern <> | Date | Mon, 14 Dec 2015 11:59:15 -0700 |
| |
On 12/14/15 10:45 AM, Ben Hutchings wrote: > On Sat, 2015-12-12 at 12:05 -0800, Greg Kroah-Hartman wrote: >> 4.3-stable review patch. If anyone has any objections, please let me >> know. >> >> ------------------ >> >> From: Nikolay Aleksandrov <nikolay@cumulusnetworks.com> >> >> [ Upstream commit 7f109f7cc37108cba7243bc832988525b0d85909 ] > [...] >> --- a/drivers/net/vrf.c >> +++ b/drivers/net/vrf.c >> @@ -581,7 +581,6 @@ static int vrf_newlink(struct net *src_n >> { >> struct net_vrf *vrf = netdev_priv(dev); >> struct net_vrf_dev *vrf_ptr; >> - int err; >> >> if (!data || !data[IFLA_VRF_TABLE]) >> return -EINVAL; >> @@ -590,26 +589,16 @@ static int vrf_newlink(struct net *src_n >> >> dev->priv_flags |= IFF_VRF_MASTER; >> >> - err = -ENOMEM; >> vrf_ptr = kmalloc(sizeof(*dev->vrf_ptr), GFP_KERNEL); >> if (!vrf_ptr) >> - goto out_fail; >> + return -ENOMEM; >> >> vrf_ptr->ifindex = dev->ifindex; >> vrf_ptr->tb_id = vrf->tb_id; >> >> - err = register_netdevice(dev); >> - if (err < 0) >> - goto out_fail; >> - >> rcu_assign_pointer(dev->vrf_ptr, vrf_ptr); >> >> - return 0; >> - >> -out_fail: >> - kfree(vrf_ptr); >> - free_netdev(dev); >> - return err; >> + return register_netdev(dev); >> } >> >> static size_t vrf_nl_getsize(const struct net_device *dev) > > This leaks *dev->vrf_ptr if register_netdevice() fails. (This bug does > not exist in the mainline version, as net_device::vrf_ptr no longer > exists there.)
Good catch. The backport just needs to drop the free_netdev call:
diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c index 488c6f50df73..374feba02565 100644 --- a/drivers/net/vrf.c +++ b/drivers/net/vrf.c @@ -608,7 +608,6 @@ static int vrf_newlink(struct net *src_net, struct net_device *dev,
out_fail: kfree(vrf_ptr); - free_netdev(dev); return err; }
| |