linux-kernel - Re: [PATCH] can: vxcan: Fix memleak in vxcan

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 21 Oct 2020 13:20:16 +0200
From:   Oliver Hartkopp <socketcan@...tkopp.net>
To:     Dinghao Liu <dinghao.liu@....edu.cn>, kjlu@....edu
Cc:     Wolfgang Grandegger <wg@...ndegger.com>,
        Marc Kleine-Budde <mkl@...gutronix.de>,
        "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>, linux-can@...r.kernel.org,
        netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] can: vxcan: Fix memleak in vxcan_newlink



On 21.10.20 07:21, Dinghao Liu wrote:
> When rtnl_configure_link() fails, peer needs to be
> freed just like when register_netdevice() fails.
> 
> Signed-off-by: Dinghao Liu <dinghao.liu@....edu.cn>

Acked-by: Oliver Hartkopp <socketcan@...tkopp.net>

Btw. as the vxcan.c driver bases on veth.c the same issue can be found 
there!

At this point:
https://elixir.bootlin.com/linux/latest/source/drivers/net/veth.c#L1398

err_register_dev:
         /* nothing to do */
err_configure_peer:
         unregister_netdevice(peer);
         return err; <<<<<<<<<<<<<<<<<<<<<<<

err_register_peer:
         free_netdev(peer);
         return err;
}

IMO the return must be removed to fall through the next label and free 
the netdevice too.

Would you like so send a patch for veth.c too?

Best regards,
Oliver

> ---
>   drivers/net/can/vxcan.c | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/net/can/vxcan.c b/drivers/net/can/vxcan.c
> index d6ba9426be4d..aefc5a61d239 100644
> --- a/drivers/net/can/vxcan.c
> +++ b/drivers/net/can/vxcan.c
> @@ -244,6 +244,7 @@ static int vxcan_newlink(struct net *net, struct net_device *dev,
>   
>   unregister_network_device:
>   	unregister_netdevice(peer);
> +	free_netdev(peer);
>   	return err;
>   }
>   
>