Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753373AbbLNRqE (ORCPT ); Mon, 14 Dec 2015 12:46:04 -0500 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:58587 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752801AbbLNRqA (ORCPT ); Mon, 14 Dec 2015 12:46:00 -0500 Message-ID: <1450115142.3944.10.camel@decadent.org.uk> Subject: Re: [PATCH 4.3 34/71] vrf: fix double free and memory corruption on register_netdevice failure From: Ben Hutchings To: Greg Kroah-Hartman , linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org, Nikolay Aleksandrov , David Ahern , "David S. Miller" Date: Mon, 14 Dec 2015 17:45:42 +0000 In-Reply-To: <20151212200538.468407629@linuxfoundation.org> References: <20151212200536.761001328@linuxfoundation.org> <20151212200538.468407629@linuxfoundation.org> Content-Type: multipart/signed; micalg="pgp-sha512"; protocol="application/pgp-signature"; boundary="=-xJ0EaQcXD6BkEMPSIvPm" X-Mailer: Evolution 3.18.2-1 Mime-Version: 1.0 X-SA-Exim-Connect-IP: 192.168.4.247 X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2957 Lines: 95 --=-xJ0EaQcXD6BkEMPSIvPm Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Sat, 2015-12-12 at 12:05 -0800, Greg Kroah-Hartman wrote: > 4.3-stable review patch.=C2=A0=C2=A0If anyone has any objections, please = let me > know. >=20 > ------------------ >=20 > From: Nikolay Aleksandrov >=20 > [ Upstream commit 7f109f7cc37108cba7243bc832988525b0d85909 ] [...] > --- a/drivers/net/vrf.c > +++ b/drivers/net/vrf.c > @@ -581,7 +581,6 @@ static int vrf_newlink(struct net *src_n > =C2=A0{ > =C2=A0 struct net_vrf *vrf =3D netdev_priv(dev); > =C2=A0 struct net_vrf_dev *vrf_ptr; > - int err; > =C2=A0 > =C2=A0 if (!data || !data[IFLA_VRF_TABLE]) > =C2=A0 return -EINVAL; > @@ -590,26 +589,16 @@ static int vrf_newlink(struct net *src_n > =C2=A0 > =C2=A0 dev->priv_flags |=3D IFF_VRF_MASTER; > =C2=A0 > - err =3D -ENOMEM; > =C2=A0 vrf_ptr =3D kmalloc(sizeof(*dev->vrf_ptr), GFP_KERNEL); > =C2=A0 if (!vrf_ptr) > - goto out_fail; > + return -ENOMEM; > =C2=A0 > =C2=A0 vrf_ptr->ifindex =3D dev->ifindex; > =C2=A0 vrf_ptr->tb_id =3D vrf->tb_id; > =C2=A0 > - err =3D register_netdevice(dev); > - if (err < 0) > - goto out_fail; > - > =C2=A0 rcu_assign_pointer(dev->vrf_ptr, vrf_ptr); > =C2=A0 > - return 0; > - > -out_fail: > - kfree(vrf_ptr); > - free_netdev(dev); > - return err; > + return register_netdev(dev); > =C2=A0} > =C2=A0 > =C2=A0static size_t vrf_nl_getsize(const struct net_device *dev) This leaks *dev->vrf_ptr if register_netdevice() fails. =C2=A0(This bug doe= s not exist in the mainline version, as net_device::vrf_ptr no longer exists there.) Ben. --=20 Ben Hutchings Once a job is fouled up, anything done to improve it makes it worse. --=-xJ0EaQcXD6BkEMPSIvPm Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUAVm8ARue/yOyVhhEJAQrSshAA1b3QxPOnrKsXqgow1NbWtz2zQszPMrrv nHspmFyspOJRxy7LqndbZISRbojz2LX7T2C+jNja5U8NFuCypwZgdkORItFM62Qq zVSwujTUz41xKGrTkS4GZWzEatzm0pdVpr3Oar/JLiM41WfJoY3ti5YFvZUIXJlc l6QnxEyB0XBFoyfj9V5cFRotkh1c8Sygq/1DpaSP8qyEO1ii/8vbuT2wweZ+vuYE pi2SLaa82sIc0Wjn+ET0UksT4EcV5A+/q0fy0JiO5TyOWX4P3yUsfXxN3L7kKbvL iiZkzYdc0mwcogzohphHr5bkGgSZ6L6oQbHeDbIs8Q3ucTtcVzJlPMvuMmmExWEA Oe1WlFEnfRwLtO/ZRG84o+MwyjzNEgQFOMwLy3qyTnKhV6sfxL5Eobh5x4xg6rss lBbAvqFyhsToLmBP7m+RKdgVo8Z2TcJcoZ0+ft+eZCn5NwBmGPlDUwqA5DWBsxMQ rR2pLab13V2YdkU9H3GIAiARelQmi5kztjHVW5qDxiRMgzWR71pGmMM+wOZK/TLD jcPkAM2iDkHJR6VSbiTzgx0lGzXCiwtk5xHZuE2P+8S40JJOH1ySCY/4TPnumGPy LOeeA16kF9kRpB8YHnzSoN09MdO8fm8sD5Fbn7Gxx9pAPSkGrn1hulNBvNTR7H0X G81Vv7Eg6Js= =5wnC -----END PGP SIGNATURE----- --=-xJ0EaQcXD6BkEMPSIvPm-- -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/