netdev - Re: [PATCH 1/1] drivers: net: mhi: fix error path in mhi_net

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 24 Sep 2021 13:11:55 +0200
From:   Daniele Palmas <dnlplm@...il.com>
To:     Manivannan Sadhasivam <mani@...nel.org>
Cc:     Loic Poulain <loic.poulain@...aro.org>,
        "David S . Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        Network Development <netdev@...r.kernel.org>
Subject: Re: [PATCH 1/1] drivers: net: mhi: fix error path in mhi_net_newlink

Hi Mani,

Il giorno ven 24 set 2021 alle ore 11:49 Manivannan Sadhasivam
<mani@...nel.org> ha scritto:
>
> On Fri, Sep 24, 2021 at 11:26:52AM +0200, Daniele Palmas wrote:
> > Fix double free_netdev when mhi_prepare_for_transfer fails.
> >
> > Fixes: 3ffec6a14f24 ("net: Add mhi-net driver")
> > Signed-off-by: Daniele Palmas <dnlplm@...il.com>
>
> I guess this patch should be backported to stable kernels. So please CC stable
> list.

Just v5.14.x seems to be affected by the same issue, but it requires a
slightly different patch: I'll try to take care of that.

Thanks,
Daniele

>
> Reviewed-by: Manivannan Sadhasivam <mani@...nel.org>
>
> Thanks,
> Mani
>
> > ---
> >  drivers/net/mhi_net.c | 6 +-----
> >  1 file changed, 1 insertion(+), 5 deletions(-)
> >
> > diff --git a/drivers/net/mhi_net.c b/drivers/net/mhi_net.c
> > index d127eb6e9257..aaa628f859fd 100644
> > --- a/drivers/net/mhi_net.c
> > +++ b/drivers/net/mhi_net.c
> > @@ -321,7 +321,7 @@ static int mhi_net_newlink(struct mhi_device *mhi_dev, struct net_device *ndev)
> >       /* Start MHI channels */
> >       err = mhi_prepare_for_transfer(mhi_dev);
> >       if (err)
> > -             goto out_err;
> > +             return err;
> >
> >       /* Number of transfer descriptors determines size of the queue */
> >       mhi_netdev->rx_queue_sz = mhi_get_free_desc_count(mhi_dev, DMA_FROM_DEVICE);
> > @@ -331,10 +331,6 @@ static int mhi_net_newlink(struct mhi_device *mhi_dev, struct net_device *ndev)
> >               return err;
> >
> >       return 0;
> > -
> > -out_err:
> > -     free_netdev(ndev);
> > -     return err;
> >  }
> >
> >  static void mhi_net_dellink(struct mhi_device *mhi_dev, struct net_device *ndev)
> > --
> > 2.30.2
> >