[PATCH 3.16 352/366] ppp: Fix null pointer dereference on registration failure
From: Ben Hutchings <hidden>
Date: 2018-10-14 15:58:56
Also in:
lkml
From: Ben Hutchings <hidden>
Date: 2018-10-14 15:58:56
Also in:
lkml
3.16.60-rc1 review patch. If anyone has any objections, please let me know. ------------------ From: Ben Hutchings <redacted> register_netdevice() will call the device's ndo_uninit operation if registration fails after it calls the ndo_init operation. However ppp_dev_uninit() uses ppp->ppp_net which is currently not set until after register_netdevice() returns. This was fixed upstream as part of commit 6d934c70db6e "ppp: add rtnetlink device creation support". Signed-off-by: Ben Hutchings <redacted> ---
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c@@ -2732,6 +2732,7 @@ static struct ppp *ppp_create_interface( ppp = netdev_priv(dev); ppp->dev = dev; + ppp->ppp_net = net; ppp->mru = PPP_MRU; init_ppp_file(&ppp->file, INTERFACE); ppp->file.hdrlen = PPP_HDRLEN - 2; /* don't count proto bytes */
@@ -2801,8 +2802,6 @@ static struct ppp *ppp_create_interface( goto out2; } - ppp->ppp_net = net; - atomic_inc(&ppp_unit_count); mutex_unlock(&pn->all_ppp_mutex); rtnl_unlock();