* [bug report] net: ipv6: check return value of rhashtable_init
@ 2021-10-04 10:36 Dan Carpenter
0 siblings, 0 replies; 2+ messages in thread
From: Dan Carpenter @ 2021-10-04 10:36 UTC (permalink / raw)
To: shjy180909; +Cc: kernel-janitors
Hello MichelleJin,
The patch f04ed7d277e8: "net: ipv6: check return value of
rhashtable_init" from Sep 27, 2021, leads to the following
Smatch static checker warning:
net/ipv6/seg6.c:379 seg6_net_init()
warn: 'sdata' was already freed.
net/ipv6/seg6.c
358 static int __net_init seg6_net_init(struct net *net)
359 {
360 struct seg6_pernet_data *sdata;
361
362 sdata = kzalloc(sizeof(*sdata), GFP_KERNEL);
363 if (!sdata)
364 return -ENOMEM;
365
366 mutex_init(&sdata->lock);
367
368 sdata->tun_src = kzalloc(sizeof(*sdata->tun_src), GFP_KERNEL);
369 if (!sdata->tun_src) {
370 kfree(sdata);
371 return -ENOMEM;
372 }
373
374 net->ipv6.seg6_data = sdata;
375
376 #ifdef CONFIG_IPV6_SEG6_HMAC
377 if (seg6_hmac_net_init(net)) {
378 kfree(sdata);
--> 379 kfree(rcu_dereference_raw(sdata->tun_src));
380 return -ENOMEM;
381 };
382 #endif
383
384 return 0;
385 }
regards,
dan carpenter
^ permalink raw reply [flat|nested] 2+ messages in thread
* [bug report] net: ipv6: check return value of rhashtable_init
@ 2021-10-01 13:09 Dan Carpenter
0 siblings, 0 replies; 2+ messages in thread
From: Dan Carpenter @ 2021-10-01 13:09 UTC (permalink / raw)
To: shjy180909; +Cc: netdev
Hello MichelleJin,
The patch f04ed7d277e8: "net: ipv6: check return value of
rhashtable_init" from Sep 27, 2021, leads to the following
Smatch static checker warning:
net/ipv6/seg6.c:379 seg6_net_init()
warn: 'sdata' was already freed.
net/ipv6/seg6.c
358 static int __net_init seg6_net_init(struct net *net)
359 {
360 struct seg6_pernet_data *sdata;
361
362 sdata = kzalloc(sizeof(*sdata), GFP_KERNEL);
363 if (!sdata)
364 return -ENOMEM;
365
366 mutex_init(&sdata->lock);
367
368 sdata->tun_src = kzalloc(sizeof(*sdata->tun_src), GFP_KERNEL);
369 if (!sdata->tun_src) {
370 kfree(sdata);
371 return -ENOMEM;
372 }
373
374 net->ipv6.seg6_data = sdata;
375
376 #ifdef CONFIG_IPV6_SEG6_HMAC
377 if (seg6_hmac_net_init(net)) {
378 kfree(sdata);
^^^^^
--> 379 kfree(rcu_dereference_raw(sdata->tun_src));
^^^^^
Use after free. The truth is that I don't understand RCU well enough
to say if just changing the order of this code is enough to fix it?
380 return -ENOMEM;
381 };
382 #endif
383
384 return 0;
385 }
regards,
dan carpenter
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-10-04 10:36 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-10-04 10:36 [bug report] net: ipv6: check return value of rhashtable_init Dan Carpenter
-- strict thread matches above, loose matches on Subject: below --
2021-10-01 13:09 Dan Carpenter
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.