netdev - Re: [PATCH 4.4-stable] slip: stop double free sl->dev in slip

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <4e89e339-e161-fd8e-85e0-e59cdcc9688f@huawei.com>
Date:   Mon, 24 Feb 2020 11:06:48 +0800
From:   yangerkun <yangerkun@...wei.com>
To:     <gregkh@...uxfoundation.org>
CC:     <stable@...r.kernel.org>, <davem@...emloft.net>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: Re: [PATCH 4.4-stable] slip: stop double free sl->dev in slip_open

cc David and netdev mail list too.

On 2020/2/22 17:46, yangerkun wrote:
> After commit e4c157955483 ("slip: Fix use-after-free Read in slip_open"),
> we will double free sl->dev since sl_free_netdev will free sl->dev too.
> It's fine for mainline since sl_free_netdev in mainline won't free
> sl->dev.
> 
> Signed-off-by: yangerkun <yangerkun@...wei.com>
> ---
>   drivers/net/slip/slip.c | 1 -
>   1 file changed, 1 deletion(-)
> 
> diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c
> index ef6b25ec75a1..7fe9183fad0e 100644
> --- a/drivers/net/slip/slip.c
> +++ b/drivers/net/slip/slip.c
> @@ -861,7 +861,6 @@ err_free_chan:
>   	tty->disc_data = NULL;
>   	clear_bit(SLF_INUSE, &sl->flags);
>   	sl_free_netdev(sl->dev);
> -	free_netdev(sl->dev);
>   
>   err_exit:
>   	rtnl_unlock();
>