netdev - Re: [PATCH 4.4-stable] slip: stop double free sl->dev in slip

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200227124911.GA1007215@kroah.com>
Date:   Thu, 27 Feb 2020 13:49:11 +0100
From:   Greg KH <gregkh@...uxfoundation.org>
To:     yangerkun <yangerkun@...wei.com>
Cc:     stable@...r.kernel.org, davem@...emloft.net,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: Re: [PATCH 4.4-stable] slip: stop double free sl->dev in slip_open

On Mon, Feb 24, 2020 at 11:06:48AM +0800, yangerkun wrote:
> cc David and netdev mail list too.
> 
> On 2020/2/22 17:46, yangerkun wrote:
> > After commit e4c157955483 ("slip: Fix use-after-free Read in slip_open"),
> > we will double free sl->dev since sl_free_netdev will free sl->dev too.
> > It's fine for mainline since sl_free_netdev in mainline won't free
> > sl->dev.
> > 
> > Signed-off-by: yangerkun <yangerkun@...wei.com>
> > ---
> >   drivers/net/slip/slip.c | 1 -
> >   1 file changed, 1 deletion(-)
> > 
> > diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c
> > index ef6b25ec75a1..7fe9183fad0e 100644
> > --- a/drivers/net/slip/slip.c
> > +++ b/drivers/net/slip/slip.c
> > @@ -861,7 +861,6 @@ err_free_chan:
> >   	tty->disc_data = NULL;
> >   	clear_bit(SLF_INUSE, &sl->flags);
> >   	sl_free_netdev(sl->dev);
> > -	free_netdev(sl->dev);
> >   err_exit:
> >   	rtnl_unlock();
> > 
> 

What commit causes this only to be needed on the 4.4-stable tree?  Can
you please list it in the commit log so that we know this?

And this is only for 4.4.y, not 4.9.y or anything else?  Why?

thanks,

greg k-h