From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5CA04C4BA3B for ; Thu, 27 Feb 2020 12:49:15 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 26E0824698 for ; Thu, 27 Feb 2020 12:49:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1582807755; bh=4FV306+YSxyEDrfkOQdy4IOprID1ZRXPJiAZ6ov4ztM=; h=Date:From:To:Cc:Subject:References:In-Reply-To:List-ID:From; b=aPiy31k1T8t3FylC9yNZbKA5Me7dbMVbRLcLQWhlfx5qp9OgSh4FBydzmIpCcCy0Z ixaYLqDBW421iirn7Q0rD9r0O+qEogLVEpRXtGoN9Blp6qVZrHOXjhXJYxJRRuaP8J jMT80oSVgJKwr/rDbtuVrm+t/OZZETCl5GCh70Mo= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729076AbgB0MtO (ORCPT ); Thu, 27 Feb 2020 07:49:14 -0500 Received: from mail.kernel.org ([198.145.29.99]:43028 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729034AbgB0MtO (ORCPT ); Thu, 27 Feb 2020 07:49:14 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 7A36324697; Thu, 27 Feb 2020 12:49:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1582807753; bh=4FV306+YSxyEDrfkOQdy4IOprID1ZRXPJiAZ6ov4ztM=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=J4cybJLDagJq400SbAVtqE7f4OAvGcCWgAzJ+sEsj2ZcggR5Ex5tiKYqMdpwX107c 4Oau8plE8llO+C4lCSLOPUf3ijiFyg1nzK1faBYHjszS8dA5YbvCUT50uvZ8tOqC/W N2Rs/lfK2W5pAi+RzGUzY9ns0iNF3qdDs0fMojm4= Date: Thu, 27 Feb 2020 13:49:11 +0100 From: Greg KH To: yangerkun Cc: stable@vger.kernel.org, davem@davemloft.net, "netdev@vger.kernel.org" Subject: Re: [PATCH 4.4-stable] slip: stop double free sl->dev in slip_open Message-ID: <20200227124911.GA1007215@kroah.com> References: <20200222094649.10933-1-yangerkun@huawei.com> <4e89e339-e161-fd8e-85e0-e59cdcc9688f@huawei.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <4e89e339-e161-fd8e-85e0-e59cdcc9688f@huawei.com> Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On Mon, Feb 24, 2020 at 11:06:48AM +0800, yangerkun wrote: > cc David and netdev mail list too. > > On 2020/2/22 17:46, yangerkun wrote: > > After commit e4c157955483 ("slip: Fix use-after-free Read in slip_open"), > > we will double free sl->dev since sl_free_netdev will free sl->dev too. > > It's fine for mainline since sl_free_netdev in mainline won't free > > sl->dev. > > > > Signed-off-by: yangerkun > > --- > > drivers/net/slip/slip.c | 1 - > > 1 file changed, 1 deletion(-) > > > > diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c > > index ef6b25ec75a1..7fe9183fad0e 100644 > > --- a/drivers/net/slip/slip.c > > +++ b/drivers/net/slip/slip.c > > @@ -861,7 +861,6 @@ err_free_chan: > > tty->disc_data = NULL; > > clear_bit(SLF_INUSE, &sl->flags); > > sl_free_netdev(sl->dev); > > - free_netdev(sl->dev); > > err_exit: > > rtnl_unlock(); > > > What commit causes this only to be needed on the 4.4-stable tree? Can you please list it in the commit log so that we know this? And this is only for 4.4.y, not 4.9.y or anything else? Why? thanks, greg k-h