netdev - buggy IFB driver change

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 30 Jan 2007 13:12:46 -0800 (PST)
From:	David Miller <davem@...emloft.net>
To:	jgarzik@...ox.com
CC:	netdev@...r.kernel.org, m.kozlowski@...land.pl
Subject: buggy IFB driver change


Jeff, please revert: 0c0b3ae68ec93b1db5c637d294647d1cca0df763

It's wrong.  We had a lengthy analysis of this piece of code
several months ago, and it is correct.

Consider, if we run the loop and we get an error
the following happens:

1) attempt of ifb_init_one(i) fails, therefore we should
   not try to "ifb_free_one()" on "i" since it failed
2) the loop iteration first increments "i", then it
   check for error

Therefore we must decrement "i" twice before the first
free during the cleanup.  One to "undo" the for() loop
increment, and one to "skip" the ifb_init_one() case which
failed.

commit 0c0b3ae68ec93b1db5c637d294647d1cca0df763
Author: Mariusz Kozlowski <m.kozlowski@...land.pl>
Date:   Sat Jan 27 00:00:01 2007 -0800

    net: ifb error path loop fix
    
    On error we should start freeing resources at [i-1] not [i-2].
    
    Signed-off-by: Mariusz Kozlowski <m.kozlowski@...land.pl>
    Cc: Jeff Garzik <jeff@...zik.org>
    Signed-off-by: Andrew Morton <akpm@...l.org>
    Signed-off-by: Jeff Garzik <jeff@...zik.org>

diff --git a/drivers/net/ifb.c b/drivers/net/ifb.c
index ca2b21f..c4ca7c9 100644
--- a/drivers/net/ifb.c
+++ b/drivers/net/ifb.c
@@ -271,8 +271,7 @@ static int __init ifb_init_module(void)
 	for (i = 0; i < numifbs && !err; i++)
 		err = ifb_init_one(i);
 	if (err) {
-		i--;
-		while (--i >= 0)
+		while (i--)
 			ifb_free_one(i);
 	}
 
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html