From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Taehee Yoo <ap420073@gmail.com>,
"David S. Miller" <davem@davemloft.net>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH 4.19 33/86] bonding: check error value of register_netdevice() immediately
Date: Mon, 27 Jul 2020 16:04:07 +0200 [thread overview]
Message-ID: <20200727134916.099777793@linuxfoundation.org> (raw)
In-Reply-To: <20200727134914.312934924@linuxfoundation.org>
From: Taehee Yoo <ap420073@gmail.com>
[ Upstream commit 544f287b84959203367cd29e16e772717612fab4 ]
If register_netdevice() is failed, net_device should not be used
because variables are uninitialized or freed.
So, the routine should be stopped immediately.
But, bond_create() doesn't check return value of register_netdevice()
immediately. That will result in a panic because of using uninitialized
or freed memory.
Test commands:
modprobe netdev-notifier-error-inject
echo -22 > /sys/kernel/debug/notifier-error-inject/netdev/\
actions/NETDEV_REGISTER/error
modprobe bonding max_bonds=3
Splat looks like:
[ 375.028492][ T193] general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] SMP DEBUG_PAGEALLOC PTI
[ 375.033207][ T193] CPU: 2 PID: 193 Comm: kworker/2:2 Not tainted 5.8.0-rc4+ #645
[ 375.036068][ T193] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
[ 375.039673][ T193] Workqueue: events linkwatch_event
[ 375.041557][ T193] RIP: 0010:dev_activate+0x4a/0x340
[ 375.043381][ T193] Code: 40 a8 04 0f 85 db 00 00 00 8b 83 08 04 00 00 85 c0 0f 84 0d 01 00 00 31 d2 89 d0 48 8d 04 40 48 c1 e0 07 48 03 83 00 04 00 00 <48> 8b 48 10 f6 41 10 01 75 08 f0 80 a1 a0 01 00 00 fd 48 89 48 08
[ 375.050267][ T193] RSP: 0018:ffff9f8facfcfdd8 EFLAGS: 00010202
[ 375.052410][ T193] RAX: 6b6b6b6b6b6b6b6b RBX: ffff9f8fae6ea000 RCX: 0000000000000006
[ 375.055178][ T193] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9f8fae6ea000
[ 375.057762][ T193] RBP: ffff9f8fae6ea000 R08: 0000000000000000 R09: 0000000000000000
[ 375.059810][ T193] R10: 0000000000000001 R11: 0000000000000000 R12: ffff9f8facfcfe08
[ 375.061892][ T193] R13: ffffffff883587e0 R14: 0000000000000000 R15: ffff9f8fae6ea580
[ 375.063931][ T193] FS: 0000000000000000(0000) GS:ffff9f8fbae00000(0000) knlGS:0000000000000000
[ 375.066239][ T193] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 375.067841][ T193] CR2: 00007f2f542167a0 CR3: 000000012cee6002 CR4: 00000000003606e0
[ 375.069657][ T193] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 375.071471][ T193] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 375.073269][ T193] Call Trace:
[ 375.074005][ T193] linkwatch_do_dev+0x4d/0x50
[ 375.075052][ T193] __linkwatch_run_queue+0x10b/0x200
[ 375.076244][ T193] linkwatch_event+0x21/0x30
[ 375.077274][ T193] process_one_work+0x252/0x600
[ 375.078379][ T193] ? process_one_work+0x600/0x600
[ 375.079518][ T193] worker_thread+0x3c/0x380
[ 375.080534][ T193] ? process_one_work+0x600/0x600
[ 375.081668][ T193] kthread+0x139/0x150
[ 375.082567][ T193] ? kthread_park+0x90/0x90
[ 375.083567][ T193] ret_from_fork+0x22/0x30
Fixes: e826eafa65c6 ("bonding: Call netif_carrier_off after register_netdevice")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/bonding/bond_main.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index f57b86f1373d4..11429df743067 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -4817,15 +4817,19 @@ int bond_create(struct net *net, const char *name)
bond_dev->rtnl_link_ops = &bond_link_ops;
res = register_netdevice(bond_dev);
+ if (res < 0) {
+ free_netdev(bond_dev);
+ rtnl_unlock();
+
+ return res;
+ }
netif_carrier_off(bond_dev);
bond_work_init_all(bond);
rtnl_unlock();
- if (res < 0)
- free_netdev(bond_dev);
- return res;
+ return 0;
}
static int __net_init bond_net_init(struct net *net)
--
2.25.1
next prev parent reply other threads:[~2020-07-27 14:38 UTC|newest]
Thread overview: 110+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-27 14:03 [PATCH 4.19 00/86] 4.19.135-rc1 review Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 01/86] soc: qcom: rpmh: Dirt can only make you dirtier, not cleaner Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 02/86] gpio: arizona: handle pm_runtime_get_sync failure case Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 03/86] gpio: arizona: put pm_runtime in case of failure Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 04/86] pinctrl: amd: fix npins for uart0 in kerncz_groups Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 05/86] mac80211: allow rx of mesh eapol frames with default rx key Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 06/86] scsi: scsi_transport_spi: Fix function pointer check Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 07/86] xtensa: fix __sync_fetch_and_{and,or}_4 declarations Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 08/86] xtensa: update *pos in cpuinfo_op.next Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 09/86] drivers/net/wan/lapbether: Fixed the value of hard_header_len Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 10/86] net: sky2: initialize return of gm_phy_read Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 11/86] drm/nouveau/i2c/g94-: increase NV_PMGR_DP_AUXCTL_TRANSACTREQ timeout Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 12/86] drivers/firmware/psci: Fix memory leakage in alloc_init_cpu_groups() Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 13/86] fuse: fix weird page warning Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 14/86] irqdomain/treewide: Keep firmware node unconditionally allocated Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 15/86] SUNRPC reverting d03727b248d0 ("NFSv4 fix CLOSE not waiting for direct IO compeletion") Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 16/86] spi: spi-fsl-dspi: Exit the ISR with IRQ_NONE when its not ours Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 17/86] tipc: clean up skb list lock handling on send path Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 18/86] IB/umem: fix reference count leak in ib_umem_odp_get() Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 19/86] uprobes: Change handle_swbp() to send SIGTRAP with si_code=SI_KERNEL, to fix GDB regression Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 20/86] ALSA: info: Drop WARN_ON() from buffer NULL sanity check Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 21/86] ASoC: rt5670: Correct RT5670_LDO_SEL_MASK Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 22/86] btrfs: fix double free on ulist after backref resolution failure Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 23/86] btrfs: fix mount failure caused by race with umount Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 24/86] btrfs: fix page leaks after failure to lock page for delalloc Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 25/86] bnxt_en: Fix race when modifying pause settings Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 26/86] fpga: dfl: fix bug in port reset handshake Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 27/86] hippi: Fix a size used in a pci_free_consistent() in an error handling path Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 28/86] ax88172a: fix ax88172a_unbind() failures Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 29/86] net: dp83640: fix SIOCSHWTSTAMP to update the struct with actual configuration Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 30/86] ieee802154: fix one possible memleak in adf7242_probe Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 31/86] drm: sun4i: hdmi: Fix inverted HPD result Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 32/86] net: smc91x: Fix possible memory leak in smc_drv_probe() Greg Kroah-Hartman
2020-07-27 14:04 ` Greg Kroah-Hartman [this message]
2020-07-27 14:04 ` [PATCH 4.19 34/86] mlxsw: destroy workqueue when trap_register in mlxsw_emad_init Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 35/86] qed: suppress "dont support RoCE & iWARP" flooding on HW init Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 36/86] ipvs: fix the connection sync failed in some cases Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 37/86] net: ethernet: ave: Fix error returns in ave_init Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 38/86] i2c: rcar: always clear ICSAR to avoid side effects Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 39/86] bonding: check return value of register_netdevice() in bond_newlink() Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 40/86] serial: exar: Fix GPIO configuration for Sealevel cards based on XR17V35X Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 41/86] scripts/decode_stacktrace: strip basepath from all paths Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 42/86] scripts/gdb: fix lx-symbols gdb.error while loading modules Greg Kroah-Hartman
2020-07-27 14:26 ` Kieran Bingham
2020-07-27 14:37 ` Stefano Garzarella
2020-07-27 14:40 ` Kieran Bingham
2020-07-27 14:38 ` Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 43/86] HID: i2c-hid: add Mediacom FlexBook edge13 to descriptor override Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 44/86] HID: alps: support devices with report id 2 Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 45/86] HID: steam: fixes race in handling device list Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 46/86] HID: apple: Disable Fn-key key-re-mapping on clone keyboards Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 47/86] dmaengine: tegra210-adma: Fix runtime PM imbalance on error Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 48/86] Input: add `SW_MACHINE_COVER` Greg Kroah-Hartman
2020-07-27 21:26 ` Pavel Machek
2020-07-27 22:00 ` Dmitry Torokhov
2020-07-27 14:04 ` [PATCH 4.19 49/86] spi: mediatek: use correct SPI_CFG2_REG MACRO Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 50/86] regmap: dev_get_regmap_match(): fix string comparison Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 51/86] hwmon: (aspeed-pwm-tacho) Avoid possible buffer overflow Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 52/86] dmaengine: ioat setting ioat timeout as module parameter Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 53/86] Input: synaptics - enable InterTouch for ThinkPad X1E 1st gen Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 54/86] Input: elan_i2c - only increment wakeup count on touch Greg Kroah-Hartman
2020-07-27 21:29 ` Pavel Machek
2020-07-27 22:01 ` Dmitry Torokhov
2020-07-27 22:18 ` dbasehore .
2020-07-27 23:29 ` Sasha Levin
2020-07-27 14:04 ` [PATCH 4.19 55/86] usb: gadget: udc: gr_udc: fix memleak on error handling path in gr_ep_init() Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 56/86] hwmon: (adm1275) Make sure we are reading enough data for different chips Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 57/86] hwmon: (scmi) Fix potential buffer overflow in scmi_hwmon_probe() Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 58/86] arm64: Use test_tsk_thread_flag() for checking TIF_SINGLESTEP Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 59/86] x86: math-emu: Fix up cmp insn for clang ias Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 60/86] RISC-V: Upgrade smp_mb__after_spinlock() to iorw,iorw Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 61/86] binder: Dont use mmput() from shrinker function Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 62/86] usb: xhci-mtk: fix the failure of bandwidth allocation Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 63/86] usb: xhci: Fix ASM2142/ASM3142 DMA addressing Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 64/86] Revert "cifs: Fix the target file was deleted when rename failed." Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 65/86] staging: wlan-ng: properly check endpoint types Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 66/86] staging: comedi: addi_apci_1032: check INSN_CONFIG_DIGITAL_TRIG shift Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 67/86] staging: comedi: ni_6527: fix INSN_CONFIG_DIGITAL_TRIG support Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 68/86] staging: comedi: addi_apci_1500: check INSN_CONFIG_DIGITAL_TRIG shift Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 69/86] staging: comedi: addi_apci_1564: " Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 70/86] serial: 8250: fix null-ptr-deref in serial8250_start_tx() Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 71/86] serial: 8250_mtk: Fix high-speed baud rates clamping Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 72/86] fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 73/86] vt: Reject zero-sized screen buffer size Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 74/86] Makefile: Fix GCC_TOOLCHAIN_DIR prefix for Clang cross compilation Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 75/86] mm/memcg: fix refcount error while moving and swapping Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 76/86] mm: memcg/slab: fix memory leak at non-root kmem_cache destroy Greg Kroah-Hartman
2020-07-28 12:56 ` [External] " Muchun Song
2020-07-28 15:00 ` Greg Kroah-Hartman
2020-07-28 15:17 ` Sasha Levin
2020-07-28 15:27 ` Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 77/86] io-mapping: indicate mapping failure Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 78/86] drm/amdgpu: Fix NULL dereference in dpm sysfs handlers Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 79/86] drm/amd/powerplay: fix a crash when overclocking Vega M Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 80/86] parisc: Add atomic64_set_release() define to avoid CPU soft lockups Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 81/86] x86, vmlinux.lds: Page-align end of ..page_aligned sections Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 82/86] ASoC: rt5670: Add new gpio1_is_ext_spk_en quirk and enable it on the Lenovo Miix 2 10 Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 83/86] ASoC: qcom: Drop HAS_DMA dependency to fix link failure Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 84/86] dm integrity: fix integrity recalculation that is improperly skipped Greg Kroah-Hartman
2020-07-27 20:56 ` Pavel Machek
2020-07-27 23:31 ` Sasha Levin
2020-07-28 0:24 ` Mike Snitzer
2020-07-27 14:04 ` [PATCH 4.19 85/86] ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb Greg Kroah-Hartman
2020-07-27 14:05 ` [PATCH 4.19 86/86] ath9k: Fix regression with Atheros 9271 Greg Kroah-Hartman
2020-07-27 14:45 ` [PATCH 4.19 00/86] 4.19.135-rc1 review Thierry Reding
2020-07-28 1:37 ` Shuah Khan
2020-07-28 8:34 ` Naresh Kamboju
2020-07-28 13:03 ` [External] " Muchun Song
2020-07-28 14:35 ` Naresh Kamboju
2020-07-28 21:18 ` Pavel Machek
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200727134916.099777793@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=ap420073@gmail.com \
--cc=davem@davemloft.net \
--cc=linux-kernel@vger.kernel.org \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).