From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Jouni Hogander <jouni.hogander@unikie.com>,
"David S. Miller" <davem@davemloft.net>,
Oliver Hartkopp <socketcan@hartkopp.net>,
Lukas Bulwahn <lukas.bulwahn@gmail.com>,
Sasha Levin <sashal@kernel.org>,
netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 4.19 16/25] slip: Fix memory leak in slip_open error path
Date: Fri, 22 Nov 2019 14:48:49 -0500 [thread overview]
Message-ID: <20191122194859.24508-16-sashal@kernel.org> (raw)
In-Reply-To: <20191122194859.24508-1-sashal@kernel.org>
From: Jouni Hogander <jouni.hogander@unikie.com>
[ Upstream commit 3b5a39979dafea9d0cd69c7ae06088f7a84cdafa ]
Driver/net/can/slcan.c is derived from slip.c. Memory leak was detected
by Syzkaller in slcan. Same issue exists in slip.c and this patch is
addressing the leak in slip.c.
Here is the slcan memory leak trace reported by Syzkaller:
BUG: memory leak unreferenced object 0xffff888067f65500 (size 4096):
comm "syz-executor043", pid 454, jiffies 4294759719 (age 11.930s)
hex dump (first 32 bytes):
73 6c 63 61 6e 30 00 00 00 00 00 00 00 00 00 00 slcan0..........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000a06eec0d>] __kmalloc+0x18b/0x2c0
[<0000000083306e66>] kvmalloc_node+0x3a/0xc0
[<000000006ac27f87>] alloc_netdev_mqs+0x17a/0x1080
[<0000000061a996c9>] slcan_open+0x3ae/0x9a0
[<000000001226f0f9>] tty_ldisc_open.isra.1+0x76/0xc0
[<0000000019289631>] tty_set_ldisc+0x28c/0x5f0
[<000000004de5a617>] tty_ioctl+0x48d/0x1590
[<00000000daef496f>] do_vfs_ioctl+0x1c7/0x1510
[<0000000059068dbc>] ksys_ioctl+0x99/0xb0
[<000000009a6eb334>] __x64_sys_ioctl+0x78/0xb0
[<0000000053d0332e>] do_syscall_64+0x16f/0x580
[<0000000021b83b99>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[<000000008ea75434>] 0xfffffffffffffff
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Oliver Hartkopp <socketcan@hartkopp.net>
Cc: Lukas Bulwahn <lukas.bulwahn@gmail.com>
Signed-off-by: Jouni Hogander <jouni.hogander@unikie.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/slip/slip.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c
index b008266e91eab..a5874059da9d8 100644
--- a/drivers/net/slip/slip.c
+++ b/drivers/net/slip/slip.c
@@ -855,6 +855,7 @@ static int slip_open(struct tty_struct *tty)
sl->tty = NULL;
tty->disc_data = NULL;
clear_bit(SLF_INUSE, &sl->flags);
+ free_netdev(sl->dev);
err_exit:
rtnl_unlock();
--
2.20.1
next prev parent reply other threads:[~2019-11-22 19:54 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-11-22 19:48 [PATCH AUTOSEL 4.19 01/25] autofs: fix a leak in autofs_expire_indirect() Sasha Levin
2019-11-22 19:48 ` [PATCH AUTOSEL 4.19 02/25] RDMA/hns: Correct the value of HNS_ROCE_HEM_CHUNK_LEN Sasha Levin
2019-11-22 19:48 ` [PATCH AUTOSEL 4.19 03/25] xfrm: Fix memleak on xfrm state destroy Sasha Levin
2019-11-22 19:48 ` [PATCH AUTOSEL 4.19 04/25] iwlwifi: pcie: don't consider IV len in A-MSDU Sasha Levin
2019-11-22 19:48 ` [PATCH AUTOSEL 4.19 05/25] exportfs_decode_fh(): negative pinned may become positive without the parent locked Sasha Levin
2019-11-22 19:48 ` [PATCH AUTOSEL 4.19 06/25] audit_get_nd(): don't unlock parent too early Sasha Levin
2019-11-22 19:48 ` [PATCH AUTOSEL 4.19 07/25] NFC: nxp-nci: Fix NULL pointer dereference after I2C communication error Sasha Levin
2019-11-22 19:48 ` [PATCH AUTOSEL 4.19 08/25] xfrm: release device reference for invalid state Sasha Levin
2019-11-22 19:48 ` [PATCH AUTOSEL 4.19 09/25] Input: cyttsp4_core - fix use after free bug Sasha Levin
2019-11-22 19:48 ` [PATCH AUTOSEL 4.19 10/25] sched/core: Avoid spurious lock dependencies Sasha Levin
2019-11-22 19:48 ` [PATCH AUTOSEL 4.19 11/25] perf/core: Consistently fail fork on allocation failures Sasha Levin
2019-11-22 19:48 ` [PATCH AUTOSEL 4.19 12/25] ALSA: pcm: Fix stream lock usage in snd_pcm_period_elapsed() Sasha Levin
2019-11-22 19:48 ` [PATCH AUTOSEL 4.19 13/25] drm/sun4i: tcon: Set min division of TCON0_DCLK to 1 Sasha Levin
2019-11-22 19:48 ` [PATCH AUTOSEL 4.19 14/25] selftests: kvm: fix build with glibc >= 2.30 Sasha Levin
2019-11-22 19:48 ` [PATCH AUTOSEL 4.19 15/25] net: usb: qmi_wwan: add support for Foxconn T77W968 LTE modules Sasha Levin
2019-11-22 19:48 ` Sasha Levin [this message]
2019-11-22 19:48 ` [PATCH AUTOSEL 4.19 17/25] net: cdc_ncm: Signedness bug in cdc_ncm_set_dgram_size() Sasha Levin
2019-11-22 19:48 ` [PATCH AUTOSEL 4.19 18/25] slcan: Fix memory leak in error path Sasha Levin
2019-11-22 19:48 ` [PATCH AUTOSEL 4.19 19/25] rsxx: add missed destroy_workqueue calls in remove Sasha Levin
2019-11-22 19:48 ` [PATCH AUTOSEL 4.19 20/25] ax88172a: fix information leak on short answers Sasha Levin
2019-11-22 19:48 ` [PATCH AUTOSEL 4.19 21/25] net: ep93xx_eth: fix mismatch of request_mem_region in remove Sasha Levin
2019-11-22 19:48 ` [PATCH AUTOSEL 4.19 22/25] i2c: acpi: Force bus speed to 400KHz if a Silead touchscreen is present Sasha Levin
2019-11-22 19:48 ` [PATCH AUTOSEL 4.19 23/25] i2c: core: fix use after free in of_i2c_notify Sasha Levin
2019-11-22 19:48 ` [PATCH AUTOSEL 4.19 24/25] Input: synaptics - enable RMI mode for X1 Extreme 2nd Generation Sasha Levin
2019-11-22 19:55 ` Dmitry Torokhov
2019-12-06 12:14 ` Sasha Levin
2019-11-22 19:48 ` [PATCH AUTOSEL 4.19 25/25] net: gemini: add missed free_netdev Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191122194859.24508-16-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=davem@davemloft.net \
--cc=jouni.hogander@unikie.com \
--cc=linux-kernel@vger.kernel.org \
--cc=lukas.bulwahn@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=socketcan@hartkopp.net \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).