* Re: [PATCH] [bridge] Fix double-free in br_add_if.
[not found] <1253910324-19006-1-git-send-email-x@jeffhansen.com>
@ 2009-09-25 21:33 ` Stephen Hemminger
0 siblings, 0 replies; only message in thread
From: Stephen Hemminger @ 2009-09-25 21:33 UTC (permalink / raw)
To: Jeff Hansen; +Cc: netdev, jeff, Dave Miller, Jeff Hansen
On Fri, 25 Sep 2009 14:25:24 -0600
Jeff Hansen <x@jeffhansen.com> wrote:
> There is a potential double-kfree in net/bridge/br_if.c. If br_fdb_insert
> fails, then the kobject is put back (which calls kfree due to the kobject
> release), and then kfree is called again on the net_bridge_port. This
> patch fixes the crash.
>
> Signed-off-by: Jeff Hansen <x@jeffhansen.com>
> ---
> net/bridge/br_if.c | 6 ++++--
> 1 files changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
> index eb404dc..1becec1 100644
> --- a/net/bridge/br_if.c
> +++ b/net/bridge/br_if.c
> @@ -368,7 +368,7 @@ done:
> int br_add_if(struct net_bridge *br, struct net_device *dev)
> {
> struct net_bridge_port *p;
> - int err = 0;
> + int err = 0, kobj_initted = 0;
>
> if (dev->flags & IFF_LOOPBACK || dev->type != ARPHRD_ETHER)
> return -EINVAL;
> @@ -391,6 +391,7 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
> SYSFS_BRIDGE_PORT_ATTR);
> if (err)
> goto err0;
> + kobj_initted = 1;
>
> err = br_fdb_insert(br, p, dev->dev_addr);
> if (err)
> @@ -429,7 +430,8 @@ err0:
> dev_set_promiscuity(dev, -1);
> put_back:
> dev_put(dev);
> - kfree(p);
> + if (!kobj_initted)
> + kfree(p);
> return err;
> }
>
I'll look at it, probably needs fixing, but the code style with condition
variables is out of place in this code.
^ permalink raw reply [flat|nested] only message in thread