lkml.org 
[lkml]   [2015]   [Dec]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    SubjectRe: [PATCH 4.3 34/71] vrf: fix double free and memory corruption on register_netdevice failure
    From
    Date
    On 12/14/15 10:45 AM, Ben Hutchings wrote:
    > On Sat, 2015-12-12 at 12:05 -0800, Greg Kroah-Hartman wrote:
    >> 4.3-stable review patch. If anyone has any objections, please let me
    >> know.
    >>
    >> ------------------
    >>
    >> From: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
    >>
    >> [ Upstream commit 7f109f7cc37108cba7243bc832988525b0d85909 ]
    > [...]
    >> --- a/drivers/net/vrf.c
    >> +++ b/drivers/net/vrf.c
    >> @@ -581,7 +581,6 @@ static int vrf_newlink(struct net *src_n
    >> {
    >> struct net_vrf *vrf = netdev_priv(dev);
    >> struct net_vrf_dev *vrf_ptr;
    >> - int err;
    >>
    >> if (!data || !data[IFLA_VRF_TABLE])
    >> return -EINVAL;
    >> @@ -590,26 +589,16 @@ static int vrf_newlink(struct net *src_n
    >>
    >> dev->priv_flags |= IFF_VRF_MASTER;
    >>
    >> - err = -ENOMEM;
    >> vrf_ptr = kmalloc(sizeof(*dev->vrf_ptr), GFP_KERNEL);
    >> if (!vrf_ptr)
    >> - goto out_fail;
    >> + return -ENOMEM;
    >>
    >> vrf_ptr->ifindex = dev->ifindex;
    >> vrf_ptr->tb_id = vrf->tb_id;
    >>
    >> - err = register_netdevice(dev);
    >> - if (err < 0)
    >> - goto out_fail;
    >> -
    >> rcu_assign_pointer(dev->vrf_ptr, vrf_ptr);
    >>
    >> - return 0;
    >> -
    >> -out_fail:
    >> - kfree(vrf_ptr);
    >> - free_netdev(dev);
    >> - return err;
    >> + return register_netdev(dev);
    >> }
    >>
    >> static size_t vrf_nl_getsize(const struct net_device *dev)
    >
    > This leaks *dev->vrf_ptr if register_netdevice() fails. (This bug does
    > not exist in the mainline version, as net_device::vrf_ptr no longer
    > exists there.)

    Good catch. The backport just needs to drop the free_netdev call:

    diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
    index 488c6f50df73..374feba02565 100644
    --- a/drivers/net/vrf.c
    +++ b/drivers/net/vrf.c
    @@ -608,7 +608,6 @@ static int vrf_newlink(struct net *src_net, struct
    net_device *dev,

    out_fail:
    kfree(vrf_ptr);
    - free_netdev(dev);
    return err;
    }




    \
     
     \ /
      Last update: 2015-12-14 20:21    [W:3.033 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site