Thread (2 messages) 2 messages, 2 authors, 2020-03-03

Re: [PATCH linux-4.4.y/linux-4.9.y v2] slip: stop double free sl->dev in slip_open

From: Greg KH <gregkh@linuxfoundation.org>
Date: 2020-03-03 15:45:48
Also in: stable

On Fri, Feb 28, 2020 at 09:40:48PM +0800, yangerkun wrote:
quoted hunk ↗ jump to hunk
After include 3b5a39979daf ("slip: Fix memory leak in slip_open error path")
and e58c19124189 ("slip: Fix use-after-free Read in slip_open") with 4.4.y/4.9.y.
We will trigger a bug since we can double free sl->dev in slip_open. Actually,
we should backport cf124db566e6 ("net: Fix inconsistent teardown and release
of private netdev state.") too since it has delete free_netdev from sl_free_netdev.
Fix it by delete free_netdev from slip_open.

Signed-off-by: yangerkun <redacted>
---
 drivers/net/slip/slip.c | 1 -
 1 file changed, 1 deletion(-)
diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c
index 0f8d5609ed51..d4a33baa33b6 100644
--- a/drivers/net/slip/slip.c
+++ b/drivers/net/slip/slip.c
@@ -868,7 +868,6 @@ err_free_chan:
 	tty->disc_data = NULL;
 	clear_bit(SLF_INUSE, &sl->flags);
 	sl_free_netdev(sl->dev);
-	free_netdev(sl->dev);
Thanks for this, now queued up.

greg k-h
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help