lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 23 Sep 2019 21:34:50 +0530 From: Allen <allen.pais@...cle.com> To: Jakub Kicinski <jakub.kicinski@...ronome.com> Cc: netdev@...r.kernel.org, davem@...emloft.net, linux-kernel@...r.kernel.org Subject: Re: [PATCH] drivers/net/fjes: fix a potential NULL pointer dereference > > If I'm looking at this right you are jumping to err_free_netdev without > setting the err variable. It must had been set to 0 from the return of > fjes_sw_init(). This means we will free the netdev, and return 0. This > means probe will not fail and driver's remove function will be run > at some point. fjes_remove it will try to free the netdev again. Good catch. Here's a quick diff what I should have done, --- a/drivers/net/fjes/fjes_main.c +++ b/drivers/net/fjes/fjes_main.c @@ -1236,9 +1236,21 @@ static int fjes_probe(struct platform_device *plat_dev) adapter->force_reset = false; adapter->open_guard = false; + /* Re-initialize err to -ENOMEM to handle workqueue allocation failures, + and we don't return 0 on failure. + */ + err = -ENOMEM; + adapter->txrx_wq = alloc_workqueue(DRV_NAME "/txrx", WQ_MEM_RECLAIM, 0); + if (unlikely(!adapter->txrx_wq)) + goto err_free_netdev; + adapter->control_wq = alloc_workqueue(DRV_NAME "/control", WQ_MEM_RECLAIM, 0); + if (unlikely(!adapter->control_wq)) { + destroy_workqueue(adapter->txrx_wq); + goto err_free_netdev; + } > Looks like there's another existing bug here in that the work queues > are not free when something fails in fjes_probe, just the netdev. I shall look into it and send out a separate fix. > Once you untangle that, and before you post a v2, could you please try > to identify which commit introduced the regression and provide an > appropriate "Fixes" tag? > Fixes: f2edc4e1b078("net: fjes: fjes_main: Remove create_workqueue") - Allen
Powered by blists - more mailing lists