netdev - Re: [PATCH] tap: double-free in error path in tap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <e5816501-b58c-506c-161f-8ee7a80ea347@redhat.com>
Date:   Wed, 25 Oct 2017 09:55:40 +0800
From:   Jason Wang <jasowang@...hat.com>
To:     Girish Moodalbail <girish.moodalbail@...cle.com>,
        netdev@...r.kernel.org, davem@...emloft.net
Subject: Re: [PATCH] tap: double-free in error path in tap_open()



On 2017年10月25日 05:41, Girish Moodalbail wrote:
> Double free of skb_array in tap module is causing kernel panic. When
> tap_set_queue() fails we free skb_array right away by calling
> skb_array_cleanup(). However, later on skb_array_cleanup() is called
> again by tap_sock_destruct through sock_put(). This patch fixes that
> issue.
>
> Fixes: 362899b8725b35e3 (macvtap: switch to use skb array)
> Signed-off-by: Girish Moodalbail <girish.moodalbail@...cle.com>
> ---
>   drivers/net/tap.c | 12 ++++++------
>   1 file changed, 6 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/net/tap.c b/drivers/net/tap.c
> index 21b71ae..878520b 100644
> --- a/drivers/net/tap.c
> +++ b/drivers/net/tap.c
> @@ -542,20 +542,20 @@ static int tap_open(struct inode *inode, struct file *file)
>   
>   	err = -ENOMEM;
>   	if (skb_array_init(&q->skb_array, tap->dev->tx_queue_len, GFP_KERNEL))
> -		goto err_array;
> +		goto err_put;

Looks like this will cause skb_array_cleanup() to be called when skb 
array was uninitialized?

Thanks

>   
>   	err = tap_set_queue(tap, file, q);
> -	if (err)
> -		goto err_queue;
> +	if (err) {
> +		/* tap_sock_destruct() will take care of freeing skb_array */
> +		goto err_put;
> +	}
>   
>   	dev_put(tap->dev);
>   
>   	rtnl_unlock();
>   	return err;
>   
> -err_queue:
> -	skb_array_cleanup(&q->skb_array);
> -err_array:
> +err_put:
>   	sock_put(&q->sk);
>   err:
>   	if (tap)