From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.1 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C45CBC432C0 for ; Fri, 22 Nov 2019 19:51:49 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 9BCC82070E for ; Fri, 22 Nov 2019 19:51:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1574452309; bh=D55g7ML9j5z4+gKRarcfhgQpGRZmkgK6l6KHN+PXncs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=rBXacrEwxieLe05YvubnKAzSpFjRt85Iwb23PBkkrKNtZKsbbKoIQQNdFbzXmZ6Sj Vf5ZGKAgKB9/S/2hMXPfWkkej9P8BHdSg7rREZym3XL0GSAuuS75YdpICjSxiy0Gdo KrBa7J7b2FsYLFgWf0VKtrcNCd5acYdXzBlqZzLo= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727329AbfKVTvs (ORCPT ); Fri, 22 Nov 2019 14:51:48 -0500 Received: from mail.kernel.org ([198.145.29.99]:50670 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727734AbfKVTuI (ORCPT ); Fri, 22 Nov 2019 14:50:08 -0500 Received: from sasha-vm.mshome.net (c-73-47-72-35.hsd1.nh.comcast.net [73.47.72.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id BF41A207DD; Fri, 22 Nov 2019 19:50:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1574452207; bh=D55g7ML9j5z4+gKRarcfhgQpGRZmkgK6l6KHN+PXncs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vcT0gIOi8YqNaKRm8b/FzTVifH4GSi4oVXygng9Uf8O2BVNTHfVEuKZ66EEcocOGN gHtZXK6y9PhpUVH/p+A6FGJAcTGuVv80IvjiRbSilXP1st9yZb9zApeKarXAYEuloo 0iQYnms790m+zqwKOexSLpjffJTqGvUnb2YmWZG0= From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Jouni Hogander , "David S. Miller" , Oliver Hartkopp , Lukas Bulwahn , Sasha Levin , netdev@vger.kernel.org Subject: [PATCH AUTOSEL 4.9 08/13] slip: Fix memory leak in slip_open error path Date: Fri, 22 Nov 2019 14:49:53 -0500 Message-Id: <20191122194958.24926-8-sashal@kernel.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20191122194958.24926-1-sashal@kernel.org> References: <20191122194958.24926-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Jouni Hogander [ Upstream commit 3b5a39979dafea9d0cd69c7ae06088f7a84cdafa ] Driver/net/can/slcan.c is derived from slip.c. Memory leak was detected by Syzkaller in slcan. Same issue exists in slip.c and this patch is addressing the leak in slip.c. Here is the slcan memory leak trace reported by Syzkaller: BUG: memory leak unreferenced object 0xffff888067f65500 (size 4096): comm "syz-executor043", pid 454, jiffies 4294759719 (age 11.930s) hex dump (first 32 bytes): 73 6c 63 61 6e 30 00 00 00 00 00 00 00 00 00 00 slcan0.......... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000a06eec0d>] __kmalloc+0x18b/0x2c0 [<0000000083306e66>] kvmalloc_node+0x3a/0xc0 [<000000006ac27f87>] alloc_netdev_mqs+0x17a/0x1080 [<0000000061a996c9>] slcan_open+0x3ae/0x9a0 [<000000001226f0f9>] tty_ldisc_open.isra.1+0x76/0xc0 [<0000000019289631>] tty_set_ldisc+0x28c/0x5f0 [<000000004de5a617>] tty_ioctl+0x48d/0x1590 [<00000000daef496f>] do_vfs_ioctl+0x1c7/0x1510 [<0000000059068dbc>] ksys_ioctl+0x99/0xb0 [<000000009a6eb334>] __x64_sys_ioctl+0x78/0xb0 [<0000000053d0332e>] do_syscall_64+0x16f/0x580 [<0000000021b83b99>] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [<000000008ea75434>] 0xfffffffffffffff Cc: "David S. Miller" Cc: Oliver Hartkopp Cc: Lukas Bulwahn Signed-off-by: Jouni Hogander Signed-off-by: David S. Miller Signed-off-by: Sasha Levin --- drivers/net/slip/slip.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c index 9ed6d1c1ee45f..b2317b3a542a0 100644 --- a/drivers/net/slip/slip.c +++ b/drivers/net/slip/slip.c @@ -860,6 +860,7 @@ static int slip_open(struct tty_struct *tty) sl->tty = NULL; tty->disc_data = NULL; clear_bit(SLF_INUSE, &sl->flags); + free_netdev(sl->dev); err_exit: rtnl_unlock(); -- 2.20.1