* [PATCH linux-4.4.y/linux-4.9.y v2] slip: stop double free sl->dev in slip_open
@ 2020-02-28 13:40 yangerkun
2020-03-03 15:45 ` Greg KH
0 siblings, 1 reply; 2+ messages in thread
From: yangerkun @ 2020-02-28 13:40 UTC (permalink / raw)
To: gregkh; +Cc: stable, davem, netdev, yangerkun
After include 3b5a39979daf ("slip: Fix memory leak in slip_open error path")
and e58c19124189 ("slip: Fix use-after-free Read in slip_open") with 4.4.y/4.9.y.
We will trigger a bug since we can double free sl->dev in slip_open. Actually,
we should backport cf124db566e6 ("net: Fix inconsistent teardown and release
of private netdev state.") too since it has delete free_netdev from sl_free_netdev.
Fix it by delete free_netdev from slip_open.
Signed-off-by: yangerkun <yangerkun@huawei.com>
---
drivers/net/slip/slip.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c
index 0f8d5609ed51..d4a33baa33b6 100644
--- a/drivers/net/slip/slip.c
+++ b/drivers/net/slip/slip.c
@@ -868,7 +868,6 @@ err_free_chan:
tty->disc_data = NULL;
clear_bit(SLF_INUSE, &sl->flags);
sl_free_netdev(sl->dev);
- free_netdev(sl->dev);
err_exit:
rtnl_unlock();
--
2.23.0.rc2.8.gff66981f45
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH linux-4.4.y/linux-4.9.y v2] slip: stop double free sl->dev in slip_open
2020-02-28 13:40 [PATCH linux-4.4.y/linux-4.9.y v2] slip: stop double free sl->dev in slip_open yangerkun
@ 2020-03-03 15:45 ` Greg KH
0 siblings, 0 replies; 2+ messages in thread
From: Greg KH @ 2020-03-03 15:45 UTC (permalink / raw)
To: yangerkun; +Cc: stable, davem, netdev
On Fri, Feb 28, 2020 at 09:40:48PM +0800, yangerkun wrote:
> After include 3b5a39979daf ("slip: Fix memory leak in slip_open error path")
> and e58c19124189 ("slip: Fix use-after-free Read in slip_open") with 4.4.y/4.9.y.
> We will trigger a bug since we can double free sl->dev in slip_open. Actually,
> we should backport cf124db566e6 ("net: Fix inconsistent teardown and release
> of private netdev state.") too since it has delete free_netdev from sl_free_netdev.
> Fix it by delete free_netdev from slip_open.
>
> Signed-off-by: yangerkun <yangerkun@huawei.com>
> ---
> drivers/net/slip/slip.c | 1 -
> 1 file changed, 1 deletion(-)
>
> diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c
> index 0f8d5609ed51..d4a33baa33b6 100644
> --- a/drivers/net/slip/slip.c
> +++ b/drivers/net/slip/slip.c
> @@ -868,7 +868,6 @@ err_free_chan:
> tty->disc_data = NULL;
> clear_bit(SLF_INUSE, &sl->flags);
> sl_free_netdev(sl->dev);
> - free_netdev(sl->dev);
Thanks for this, now queued up.
greg k-h
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-03-03 15:45 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-02-28 13:40 [PATCH linux-4.4.y/linux-4.9.y v2] slip: stop double free sl->dev in slip_open yangerkun
2020-03-03 15:45 ` Greg KH
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).