WANG Cong
4cd0362114
sit: fix a double free on error path ...
[ Upstream commit d7426c69a1942b2b9b709bf66b944ff09f561484 ]
Dmitry reported a double free in sit_init_net():
kernel BUG at mm/percpu.c:689!
invalid opcode: 0000 [#1 ] SMP KASAN
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 15692 Comm: syz-executor1 Not tainted 4.10.0-rc6-next-20170206 #1
Hardware name: Google Google Compute Engine/Google Compute Engine,
BIOS Google 01/01/2011
task: ffff8801c9cc27c0 task.stack: ffff88017d1d8000
RIP: 0010:pcpu_free_area+0x68b/0x810 mm/percpu.c:689
RSP: 0018:ffff88017d1df488 EFLAGS: 00010046
RAX: 0000000000010000 RBX: 00000000000007c0 RCX: ffffc90002829000
RDX: 0000000000010000 RSI: ffffffff81940efb RDI: ffff8801db841d94
RBP: ffff88017d1df590 R08: dffffc0000000000 R09: 1ffffffff0bb3bdd
R10: dffffc0000000000 R11: 00000000000135dd R12: ffff8801db841d80
R13: 0000000000038e40 R14: 00000000000007c0 R15: 00000000000007c0
FS: 00007f6ea608f700(0000) GS:ffff8801dbe00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000002000aff8 CR3: 00000001c8d44000 CR4: 00000000001426f0
DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
free_percpu+0x212/0x520 mm/percpu.c:1264
ipip6_dev_free+0x43/0x60 net/ipv6/sit.c:1335
sit_init_net+0x3cb/0xa10 net/ipv6/sit.c:1831
ops_init+0x10a/0x530 net/core/net_namespace.c:115
setup_net+0x2ed/0x690 net/core/net_namespace.c:291
copy_net_ns+0x26c/0x530 net/core/net_namespace.c:396
create_new_namespaces+0x409/0x860 kernel/nsproxy.c:106
unshare_nsproxy_namespaces+0xae/0x1e0 kernel/nsproxy.c:205
SYSC_unshare kernel/fork.c:2281 [inline]
SyS_unshare+0x64e/0xfc0 kernel/fork.c:2231
entry_SYSCALL_64_fastpath+0x1f/0xc2
This is because when tunnel->dst_cache init fails, we free dev->tstats
once in ipip6_tunnel_init() and twice in sit_init_net(). This looks
redundant but its ndo_uinit() does not seem enough to clean up everything
here. So avoid this by setting dev->tstats to NULL after the first free,
at least for -net.
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-02-18 15:11:43 +01:00
2016-09-19 20:19:34 +02:00
2016-09-23 13:47:44 -04:00
2016-10-20 14:32:22 -04:00
2016-09-10 21:19:10 -07:00
2016-09-10 21:19:10 -07:00
2017-02-04 09:47:09 +01:00
2016-12-02 10:46:59 +01:00
2016-11-22 22:50:46 +01:00
2017-02-04 09:47:10 +01:00
2016-12-05 14:48:48 -05:00
2017-02-18 15:11:40 +01:00
2017-01-26 08:24:46 +01:00
2017-02-18 15:11:41 +01:00
2016-12-03 23:54:25 -05:00
2016-11-29 20:37:26 -05:00
2017-02-04 09:47:11 +01:00
2016-10-20 14:32:22 -04:00
2016-10-18 10:28:18 -04:00
2017-02-18 15:11:42 +01:00
2017-02-18 15:11:43 +01:00
2016-09-23 06:46:57 -04:00
2017-01-19 20:18:04 +01:00
2016-10-07 15:36:58 -07:00
2016-11-30 14:14:08 -05:00
2016-09-10 23:12:53 -07:00
2016-09-17 10:05:05 -04:00
2017-02-14 15:25:38 -08:00
2016-09-19 20:19:34 +02:00
2017-02-04 09:47:11 +01:00
2016-10-20 11:23:08 -04:00
2016-11-24 14:43:35 +01:00
2016-12-05 19:43:42 -05:00
2017-02-04 09:47:09 +01:00
2017-02-04 09:47:09 +01:00
2016-12-02 13:29:26 -05:00
2016-10-13 08:43:17 +01:00
2017-02-18 15:11:41 +01:00
2017-02-18 15:11:42 +01:00
2016-10-12 01:51:49 -04:00
2017-02-09 08:08:27 +01:00
2016-10-19 10:58:04 -04:00
2016-12-02 14:03:20 -05:00
2017-02-04 09:47:10 +01:00
2017-01-09 08:32:23 +01:00
2017-02-14 15:25:37 -08:00
2016-09-09 18:13:30 -07:00
2016-11-30 10:58:53 +01:00
2016-08-17 19:36:23 -04:00
2016-08-17 19:36:23 -04:00
2016-11-17 00:00:23 -05:00
2016-10-06 09:52:23 -07:00
4cd0362114