netdev - [RFC PATCH v2 3/5] net: lorawan: Fix net device leakage

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20190131162809.18583-1-starnight@g.ncu.edu.tw>
Date:   Fri,  1 Feb 2019 00:28:09 +0800
From:   Jian-Hong Pan <starnight@...cu.edu.tw>
To:     Andreas Färber <afaerber@...e.de>
Cc:     netdev@...r.kernel.org, linux-lpwan@...ts.infradead.org,
        Ben Whitten <ben.whitten@...rdtech.com>,
        Jian-Hong Pan <starnight@...cu.edu.tw>
Subject: [RFC PATCH v2 3/5] net: lorawan: Fix net device leakage

The net device may be missed to be put after error check.  This patch
fixes the issue to prevent the leakage.

Fixes: 48e5bb6cec79 ("net: Prepare LoRaWAN socket module")
Signed-off-by: Jian-Hong Pan <starnight@...cu.edu.tw>
---
v2:
- Modify the commit message

 net/lorawan/socket.c | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/net/lorawan/socket.c b/net/lorawan/socket.c
index 38cee1ff02af..c94dc0f3cf82 100644
--- a/net/lorawan/socket.c
+++ b/net/lorawan/socket.c
@@ -51,8 +51,10 @@ lrw_get_dev_by_addr(struct net *net, u32 devaddr)
 
 	rcu_read_lock();
 	ndev = dev_getbyhwaddr_rcu(net, ARPHRD_LORAWAN, (char *)&be_addr);
-	if (ndev)
+	if (ndev && ndev->type == ARPHRD_LORAWAN)
 		dev_hold(ndev);
+	else
+		ndev = NULL;
 	rcu_read_unlock();
 
 	return ndev;
@@ -99,11 +101,6 @@ dgram_bind(struct sock *sk, struct sockaddr *uaddr, int len)
 	}
 	netdev_dbg(ndev, "%s: get ndev\n", __func__);
 
-	if (ndev->type != ARPHRD_LORAWAN) {
-		ret = -ENODEV;
-		goto dgram_bind_end;
-	}
-
 	ro->src_devaddr = addr->addr_in.devaddr;
 	ro->bound = 1;
 	ret = 0;
@@ -152,7 +149,7 @@ dgram_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
 	if (size > ndev->mtu) {
 		netdev_dbg(ndev, "size = %zu, mtu = %u\n", size, ndev->mtu);
 		ret = -EMSGSIZE;
-		goto dgram_sendmsg_end;
+		goto dgram_sendmsg_no_skb;
 	}
 
 	netdev_dbg(ndev, "%s: create skb\n", __func__);
@@ -189,7 +186,6 @@ dgram_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
 	kfree_skb(skb);
 dgram_sendmsg_no_skb:
 	dev_put(ndev);
-
 dgram_sendmsg_end:
 	return ret;
 }
-- 
2.20.1