linux-kernel - Re: [RFC PATCH 3/5] net; lorawan: Fix net device leakage

Open Source and information security mailing list archives

Message-ID: <20190116143431.GG5265@nanopsycho>
Date:   Wed, 16 Jan 2019 15:34:31 +0100
From:   Jiri Pirko <jiri@...nulli.us>
To:     Jian-Hong Pan <starnight@...cu.edu.tw>
Cc:     Andreas Färber <afaerber@...e.de>,
        netdev@...r.kernel.org, linux-lpwan@...ts.infradead.org,
        Ben Whitten <ben.whitten@...rdtech.com>,
        linux-kernel@...r.kernel.org
Subject: Re: [RFC PATCH 3/5] net; lorawan: Fix net device leakage

Wed, Jan 16, 2019 at 03:24:58PM CET, starnight@...cu.edu.tw wrote:
>The net device may be missed to be put after error check.  This patch
>fixes the issue to prevent the leakage.
>
>Signed-off-by: Jian-Hong Pan <starnight@...cu.edu.tw>
>---
> net/lorawan/socket.c | 12 ++++--------
> 1 file changed, 4 insertions(+), 8 deletions(-)
>
>diff --git a/net/lorawan/socket.c b/net/lorawan/socket.c
>index 9c0722379e25..7139fab63159 100644
>--- a/net/lorawan/socket.c
>+++ b/net/lorawan/socket.c
>@@ -51,8 +51,10 @@ lrw_get_dev_by_addr(struct net *net, u32 devaddr)
> 
> 	rcu_read_lock();
> 	ndev = dev_getbyhwaddr_rcu(net, ARPHRD_LORAWAN, (char *)&be_addr);
>-	if (ndev)
>+	if (ndev && ndev->type == ARPHRD_LORAWAN)
> 		dev_hold(ndev);
>+	else
>+		ndev = NULL;
> 	rcu_read_unlock();
> 
> 	return ndev;
>@@ -99,11 +101,6 @@ dgram_bind(struct sock *sk, struct sockaddr *uaddr, int len)
> 	}
> 	netdev_dbg(ndev, "%s: get ndev\n", __func__);
> 
>-	if (ndev->type != ARPHRD_LORAWAN) {
>-		ret = -ENODEV;
>-		goto dgram_bind_end;
>-	}
>-
> 	ro->src_devaddr = addr->addr_in.devaddr;
> 	ro->bound = 1;
> 	ret = 0;
>@@ -152,7 +149,7 @@ dgram_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
> 	if (size > ndev->mtu) {
> 		netdev_dbg(ndev, "size = %zu, mtu = %u\n", size, ndev->mtu);
> 		ret = -EMSGSIZE;
>-		goto dgram_sendmsg_end;
>+		goto dgram_sendmsg_no_skb;
> 	}
> 
> 	netdev_dbg(ndev, "%s: create skb\n", __func__);
>@@ -189,7 +186,6 @@ dgram_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
> 	kfree_skb(skb);
> dgram_sendmsg_no_skb:
> 	dev_put(ndev);
>-

Please avoid hunks like this one.

> dgram_sendmsg_end:
> 	return ret;
> }
>-- 
>2.20.1
>
>
>_______________________________________________
>linux-lpwan mailing list
>linux-lpwan@...ts.infradead.org
>http://lists.infradead.org/mailman/listinfo/linux-lpwan

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives