netdev - Re: [PATCH] bonding: fix error handling if slave is busy (v2)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4EFFA44E.10507@gmail.com>
Date:	Sun, 01 Jan 2012 01:09:50 +0100
From:	Nicolas de Pesloüan 
	<nicolas.2p.debian@...il.com>
To:	Stephen Hemminger <shemminger@...tta.com>
CC:	David Miller <davem@...emloft.net>,
	Jay Vosburgh <fubar@...ibm.com>,
	Andy Gospodarek <andy@...yhouse.net>, netdev@...r.kernel.org
Subject: Re: [PATCH] bonding: fix error handling if slave is busy (v2)

Le 01/01/2012 00:26, Stephen Hemminger a écrit :
> If slave device already has a receive handler registered, then the
> error unwind of bonding device enslave function is broken.
>
> The following will leave a pointer to freed memory in the slave
> device list, causing a later kernel panic.
> # modprobe dummy
> # ip li add dummy0-1 link dummy0 type macvlan
> # modprobe bonding
> # echo +dummy0>/sys/class/net/bond0/bonding/slaves
>
> The fix is to detach the slave (which removes it from the list)
> in the unwind path.
>
> Signed-off-by: Stephen Hemminger<shemminger@...tta.com>

Thanks Stephen.

Reviewed-by: Nicolas de Pesloüan <nicolas.2p.debian@...e.fr>

> ---
> v2 - need to keep original err_close for other unwind
>
> --- a/drivers/net/bonding/bond_main.c	2011-12-30 14:20:03.171823181 -0800
> +++ b/drivers/net/bonding/bond_main.c	2011-12-31 15:20:16.493379415 -0800
> @@ -1822,7 +1822,7 @@ int bond_enslave(struct net_device *bond
>   				 "but new slave device does not support netpoll.\n",
>   				 bond_dev->name);
>   			res = -EBUSY;
> -			goto err_close;
> +			goto err_detach;
>   		}
>   	}
>   #endif
> @@ -1831,7 +1831,7 @@ int bond_enslave(struct net_device *bond
>
>   	res = bond_create_slave_symlinks(bond_dev, slave_dev);
>   	if (res)
> -		goto err_close;
> +		goto err_detach;
>
>   	res = netdev_rx_handler_register(slave_dev, bond_handle_frame,
>   					 new_slave);
> @@ -1852,6 +1852,11 @@ int bond_enslave(struct net_device *bond
>   err_dest_symlinks:
>   	bond_destroy_slave_symlinks(bond_dev, slave_dev);
>
> +err_detach:
> +	write_lock_bh(&bond->lock);
> +	bond_detach_slave(bond, new_slave);
> +	write_unlock_bh(&bond->lock);
> +
>   err_close:
>   	dev_close(slave_dev);
>
>
>
>

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html