https://github.com/torvalds/linux
Revision 0c0cf3db83f8c7c9bb141c2771a34043bcf952ef authored by Fedor Pchelkin on 13 June 2023, 19:22:20 UTC, committed by David S. Miller on 15 June 2023, 10:41:01 UTC
Inside macsec_add_dev() we free percpu macsec->secy.tx_sc.stats and
macsec->stats on some of the memory allocation failure paths. However, the
net_device is already registered to that moment: in macsec_newlink(), just
before calling macsec_add_dev(). This means that during unregister process
its priv_destructor - macsec_free_netdev() - will be called and will free
the stats again.
Remove freeing percpu stats inside macsec_add_dev() because
macsec_free_netdev() will correctly free the already allocated ones. The
pointers to unallocated stats stay NULL, and free_percpu() treats that
correctly.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Fixes: 0a28bfd4971f ("net/macsec: Add MACsec skb_metadata_dst Tx Data path support")
Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver")
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent 9eed321
Tip revision: 0c0cf3db83f8c7c9bb141c2771a34043bcf952ef authored by Fedor Pchelkin on 13 June 2023, 19:22:20 UTC
net: macsec: fix double free of percpu stats
net: macsec: fix double free of percpu stats
Tip revision: 0c0cf3d
| File | Mode | Size |
|---|---|---|
| Documentation | ||
| LICENSES | ||
| arch | ||
| block | ||
| certs | ||
| crypto | ||
| drivers | ||
| fs | ||
| include | ||
| init | ||
| io_uring | ||
| ipc | ||
| kernel | ||
| lib | ||
| mm | ||
| net | ||
| rust | ||
| samples | ||
| scripts | ||
| security | ||
| sound | ||
| tools | ||
| usr | ||
| virt | ||
| .clang-format | -rw-r--r-- | 20.1 KB |
| .cocciconfig | -rw-r--r-- | 59 bytes |
| .get_maintainer.ignore | -rw-r--r-- | 151 bytes |
| .gitattributes | -rw-r--r-- | 90 bytes |
| .gitignore | -rw-r--r-- | 2.1 KB |
| .mailmap | -rw-r--r-- | 27.9 KB |
| .rustfmt.toml | -rw-r--r-- | 369 bytes |
| COPYING | -rw-r--r-- | 496 bytes |
| CREDITS | -rw-r--r-- | 100.1 KB |
| Kbuild | -rw-r--r-- | 2.5 KB |
| Kconfig | -rw-r--r-- | 555 bytes |
| MAINTAINERS | -rw-r--r-- | 693.8 KB |
| Makefile | -rw-r--r-- | 70.1 KB |
| README | -rw-r--r-- | 727 bytes |
Computing file changes ...
