All of lore.kernel.org
 help / color / mirror / Atom feed
* [bug report] net: ipv6: check return value of rhashtable_init
@ 2021-10-01 13:09 Dan Carpenter
  0 siblings, 0 replies; 2+ messages in thread
From: Dan Carpenter @ 2021-10-01 13:09 UTC (permalink / raw)
  To: shjy180909; +Cc: netdev

Hello MichelleJin,

The patch f04ed7d277e8: "net: ipv6: check return value of
rhashtable_init" from Sep 27, 2021, leads to the following
Smatch static checker warning:

	net/ipv6/seg6.c:379 seg6_net_init()
	warn: 'sdata' was already freed.

net/ipv6/seg6.c
    358 static int __net_init seg6_net_init(struct net *net)
    359 {
    360         struct seg6_pernet_data *sdata;
    361 
    362         sdata = kzalloc(sizeof(*sdata), GFP_KERNEL);
    363         if (!sdata)
    364                 return -ENOMEM;
    365 
    366         mutex_init(&sdata->lock);
    367 
    368         sdata->tun_src = kzalloc(sizeof(*sdata->tun_src), GFP_KERNEL);
    369         if (!sdata->tun_src) {
    370                 kfree(sdata);
    371                 return -ENOMEM;
    372         }
    373 
    374         net->ipv6.seg6_data = sdata;
    375 
    376 #ifdef CONFIG_IPV6_SEG6_HMAC
    377         if (seg6_hmac_net_init(net)) {
    378                 kfree(sdata);
                              ^^^^^
--> 379                 kfree(rcu_dereference_raw(sdata->tun_src));
                                                  ^^^^^
Use after free.  The truth is that I don't understand RCU well enough
to say if just changing the order of this code is enough to fix it?

    380                 return -ENOMEM;
    381         };
    382 #endif
    383 
    384         return 0;
    385 }

regards,
dan carpenter

^ permalink raw reply	[flat|nested] 2+ messages in thread

* [bug report] net: ipv6: check return value of rhashtable_init
@ 2021-10-04 10:36 Dan Carpenter
  0 siblings, 0 replies; 2+ messages in thread
From: Dan Carpenter @ 2021-10-04 10:36 UTC (permalink / raw)
  To: shjy180909; +Cc: kernel-janitors

Hello MichelleJin,

The patch f04ed7d277e8: "net: ipv6: check return value of
rhashtable_init" from Sep 27, 2021, leads to the following
Smatch static checker warning:

	net/ipv6/seg6.c:379 seg6_net_init()
	warn: 'sdata' was already freed.

net/ipv6/seg6.c
    358 static int __net_init seg6_net_init(struct net *net)
    359 {
    360         struct seg6_pernet_data *sdata;
    361 
    362         sdata = kzalloc(sizeof(*sdata), GFP_KERNEL);
    363         if (!sdata)
    364                 return -ENOMEM;
    365 
    366         mutex_init(&sdata->lock);
    367 
    368         sdata->tun_src = kzalloc(sizeof(*sdata->tun_src), GFP_KERNEL);
    369         if (!sdata->tun_src) {
    370                 kfree(sdata);
    371                 return -ENOMEM;
    372         }
    373 
    374         net->ipv6.seg6_data = sdata;
    375 
    376 #ifdef CONFIG_IPV6_SEG6_HMAC
    377         if (seg6_hmac_net_init(net)) {
    378                 kfree(sdata);
--> 379                 kfree(rcu_dereference_raw(sdata->tun_src));
    380                 return -ENOMEM;
    381         };
    382 #endif
    383 
    384         return 0;
    385 }

regards,
dan carpenter

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2021-10-04 10:36 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-10-01 13:09 [bug report] net: ipv6: check return value of rhashtable_init Dan Carpenter
2021-10-04 10:36 Dan Carpenter

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.