[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <02404242-ab8a-5300-ec76-fb13dc3fb403@cambridgegreys.com>
Date: Mon, 21 Aug 2023 08:27:12 +0100
From: Anton Ivanov <anton.ivanov@...bridgegreys.com>
To: Richard Weinberger <richard@....at>, Minjie Du <duminjie@...o.com>
Cc: Johannes Berg <johannes@...solutions.net>,
Stephen Rothwell <sfr@...b.auug.org.au>,
linux-um <linux-um@...ts.infradead.org>,
linux-kernel <linux-kernel@...r.kernel.org>,
bpf <bpf@...r.kernel.org>,
opensource kernel <opensource.kernel@...o.com>
Subject: Re: [PATCH v4] um: vector: Fix exception handling in
vector_eth_configure()
On 19/08/2023 22:01, Richard Weinberger wrote:
> ----- Ursprüngliche Mail -----
>> The resource cleanup was incomplete in the implementation
>> of the function "vector_eth_configure".
>> Thus replace the jump target
>> "out_undo_user_init" by "out_free_netdev".
>> Delate the orphan function "out_undo_user_init"
>>
>> PATCH v1-v3: Modify the patch format.
>>
>> Signed-off-by: Minjie Du <duminjie@...o.com>
>> ---
>> arch/um/drivers/vector_kern.c | 4 +---
>> 1 file changed, 1 insertion(+), 3 deletions(-)
>>
>> diff --git a/arch/um/drivers/vector_kern.c b/arch/um/drivers/vector_kern.c
>> index 131b7cb29..7ae6ab8df 100644
>> --- a/arch/um/drivers/vector_kern.c
>> +++ b/arch/um/drivers/vector_kern.c
>> @@ -1646,7 +1646,7 @@ static void vector_eth_configure(
>> err = register_netdevice(dev);
>> rtnl_unlock();
>> if (err)
>> - goto out_undo_user_init;
>> + goto out_free_netdev;
>>
>> spin_lock(&vector_devices_lock);
>> list_add(&device->list, &vector_devices);
>> @@ -1654,8 +1654,6 @@ static void vector_eth_configure(
>>
>> return;
>>
>> -out_undo_user_init:
>> - return;
>
> I don't think this is correct.
> vector_eth_configure() cannot communicate the failure since it is of type void.
> So, vector_remove() will run and will call unregister_netdev(). That can cause a double-free.
vector_remove() will be called only once per device. It checks if the
device is in the device list and if it is not - bails. If it is in the
list it removes it from there and calls unregister_netdev() after that.
So, unless I am missing something, there is no harm here - unregister
will not be called for a device that failed to register, because the
list is updated only if the device has registered successfully.
However, on second read - if register fails, the current code leaks a
*device which was alloc-ed in the beginning of configure. So even if we
skip free_netdev, which invokes remove we still need to free that *device.
>
> Thanks,
> //richard
>
--
Anton R. Ivanov
Cambridgegreys Limited. Registered in England. Company Number 10273661
https://www.cambridgegreys.com/
Powered by blists - more mailing lists