lkml.org 
[lkml]   [2021]   [Jun]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 4.4 04/15] bonding: init notify_work earlier to avoid uninitialized use
    Date
    From: Johannes Berg <johannes.berg@intel.com>

    [ Upstream commit 35d96e631860226d5dc4de0fad0a415362ec2457 ]

    If bond_kobj_init() or later kzalloc() in bond_alloc_slave() fail,
    then we call kobject_put() on the slave->kobj. This in turn calls
    the release function slave_kobj_release() which will always try to
    cancel_delayed_work_sync(&slave->notify_work), which shouldn't be
    done on an uninitialized work struct.

    Always initialize the work struct earlier to avoid problems here.

    Syzbot bisected this down to a completely pointless commit, some
    fault injection may have been at work here that caused the alloc
    failure in the first place, which may interact badly with bisect.

    Reported-by: syzbot+bfda097c12a00c8cae67@syzkaller.appspotmail.com
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Acked-by: Jay Vosburgh <jay.vosburgh@canonical.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/bonding/bond_main.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
    index a33e8a3b5f0a..d6363ae22052 100644
    --- a/drivers/net/bonding/bond_main.c
    +++ b/drivers/net/bonding/bond_main.c
    @@ -1267,6 +1267,7 @@ static struct slave *bond_alloc_slave(struct bonding *bond,

    slave->bond = bond;
    slave->dev = slave_dev;
    + INIT_DELAYED_WORK(&slave->notify_work, bond_netdev_notify_work);

    if (bond_kobj_init(slave))
    return NULL;
    @@ -1279,7 +1280,6 @@ static struct slave *bond_alloc_slave(struct bonding *bond,
    return NULL;
    }
    }
    - INIT_DELAYED_WORK(&slave->notify_work, bond_netdev_notify_work);

    return slave;
    }
    --
    2.30.2
    \
     
     \ /
      Last update: 2021-06-03 19:19    [W:4.928 / U:1.392 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site