diff mbox series

[4.9,44/88] slip: stop double free sl->dev in slip_open

Message ID	20200310123616.884028679@linuxfoundation.org
State	New
Headers	show Return-Path: <SRS0=QSPG=43=vger.kernel.org=stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, yangerkun <yangerkun@huawei.com> Subject: [PATCH 4.9 44/88] slip: stop double free sl->dev in slip_open Date: Tue, 10 Mar 2020 13:38:52 +0100 Message-Id: <20200310123616.884028679@linuxfoundation.org> In-Reply-To: <20200310123606.543939933@linuxfoundation.org> References: <20200310123606.543939933@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk
Series	None \| expand [4.9,04/88] ext4: fix potential race between s_group_info online resizing and access [4.9,07/88] mac80211: consider more elements in parsing CRC [4.9,08/88] cfg80211: check wiphy driver existence for drvinfo report [4.9,11/88] net: ena: add missing ethtool TX timestamping indication [4.9,13/88] net: ena: rss: fix failure to get indirection table [4.9,16/88] net: ena: ena-com.c: prevent NULL pointer dereference [4.9,18/88] cfg80211: add missing policy for NL80211_ATTR_STATUS_CODE [4.9,19/88] sysrq: Restore original console_loglevel when sysrq disabled [4.9,21/88] net: fib_rules: Correctly set table field when table number exceeds 8 bits [4.9,22/88] net: phy: restore mdio regs in the iproc mdio driver [4.9,24/88] ipv6: Fix route replacement with dev-only route [4.9,27/88] net: sched: correct flower port blocking [4.9,28/88] ext4: potential crash on allocation error in ext4_alloc_flex_bg_array() [4.9,29/88] audit: fix error handling in audit_data_to_entry() [4.9,31/88] ACPI: watchdog: Fix gas->access_width usage [4.9,32/88] HID: core: fix off-by-one memset in hid_report_raw_event() [4.9,33/88] HID: core: increase HID report buffer size to 8KiB [4.9,34/88] HID: hiddev: Fix race in in hiddev_disconnect() [4.9,35/88] MIPS: VPE: Fix a double free and a memory leak in release_vpe() [4.9,38/88] serial: 8250: Check UPF_IRQ_SHARED in advance [4.9,39/88] include/linux/bitops.h: introduce BITS_PER_TYPE [4.9,40/88] net: netlink: cap max groups which will be considered in netlink_bind() [4.9,42/88] namei: only return -ECHILD from follow_dotdot_rcu() [4.9,44/88] slip: stop double free sl->dev in slip_open [4.9,46/88] drivers: net: xgene: Fix the order of the arguments of alloc_etherdev_mqs() [4.9,48/88] mm/huge_memory.c: use head to check huge zero page [4.9,49/88] audit: always check the netlink payload length in audit_receive_msg() [4.9,53/88] usb: gadget: ffs: ffs_aio_cancel(): Save/restore IRQ flags [4.9,54/88] usb: gadget: serial: fix Tx stall after buffer overflow [4.9,56/88] drm/msm/dsi: save pll state before dsi host is powered off [4.9,57/88] net: ks8851-ml: Remove 8-bit bus accessors [4.9,60/88] watchdog: da9062: do not ping the hw during stop() [4.9,63/88] cifs: dont leak -EAGAIN for stat() during reconnect [4.9,65/88] usb: quirks: add NO_LPM quirk for Logitech Screen Share [4.9,67/88] usb: core: port: do error out if usb_autopm_get_interface() fails [4.9,71/88] vt: selection, close sel_buffer race [4.9,72/88] vt: selection, push console lock down [4.9,76/88] dmaengine: tegra-apb: Prevent race conditions of tasklet vs free list [4.9,77/88] ARM: dts: ls1021a: Restore MDIO compatible to gianfar [4.9,79/88] ASoC: pcm512x: Fix unbalanced regulator enable call in probe error path [4.9,80/88] ASoC: dapm: Correct DAPM handling of active widgets during shutdown [4.9,84/88] hwmon: (adt7462) Fix an error return in ADT7462_REG_VOLT() [4.9,86/88] powerpc: fix hardware PMU exception bug on PowerVM compatibility mode systems [4.9,88/88] crypto: algif_skcipher - use ZERO_OR_NULL_PTR in skcipher_recvmsg_async

Commit Message

Greg Kroah-Hartman March 10, 2020, 12:38 p.m. UTC

From: yangerkun <yangerkun@huawei.com>

After include 3b5a39979daf ("slip: Fix memory leak in slip_open error path")
and e58c19124189 ("slip: Fix use-after-free Read in slip_open") with 4.4.y/4.9.y.
We will trigger a bug since we can double free sl->dev in slip_open. Actually,
we should backport cf124db566e6 ("net: Fix inconsistent teardown and release
of private netdev state.") too since it has delete free_netdev from sl_free_netdev.
Fix it by delete free_netdev from slip_open.

Signed-off-by: yangerkun <yangerkun@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/slip/slip.c |    1 -
 1 file changed, 1 deletion(-)

diff mbox series

Patch

--- a/drivers/net/slip/slip.c
+++ b/drivers/net/slip/slip.c
@@ -868,7 +868,6 @@  err_free_chan:
 	tty->disc_data = NULL;
 	clear_bit(SLF_INUSE, &sl->flags);
 	sl_free_netdev(sl->dev);
-	free_netdev(sl->dev);
 
 err_exit:
 	rtnl_unlock();