Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 78e0ea67 authored by Girish Moodalbail's avatar Girish Moodalbail Committed by David S. Miller
Browse files

tap: double-free in error path in tap_open() 



Double free of skb_array in tap module is causing kernel panic. When
tap_set_queue() fails we free skb_array right away by calling
skb_array_cleanup(). However, later on skb_array_cleanup() is called
again by tap_sock_destruct through sock_put(). This patch fixes that
issue.

Fixes: 362899b8 (macvtap: switch to use skb array)
Signed-off-by: default avatarGirish Moodalbail <girish.moodalbail@oracle.com>
Acked-by: default avatarJason Wang <jasowang@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 5889e2c0

drivers/net/tap.c

+9 −9
Original line number Original line Diff line number Diff line
@@ -517,6 +517,10 @@ static int tap_open(struct inode *inode, struct file *file) 
					     &tap_proto, 0);

					     &tap_proto, 0);

	if (!q)

	if (!q)

		goto err;

		goto err;

	if (skb_array_init(&q->skb_array, tap->dev->tx_queue_len, GFP_KERNEL)) {

		sk_free(&q->sk);

		goto err;

	}





	RCU_INIT_POINTER(q->sock.wq, &q->wq);

	RCU_INIT_POINTER(q->sock.wq, &q->wq);

	init_waitqueue_head(&q->wq.wait);

	init_waitqueue_head(&q->wq.wait);
@@ -540,22 +544,18 @@ static int tap_open(struct inode *inode, struct file *file) 
	if ((tap->dev->features & NETIF_F_HIGHDMA) && (tap->dev->features & NETIF_F_SG))

	if ((tap->dev->features & NETIF_F_HIGHDMA) && (tap->dev->features & NETIF_F_SG))

		sock_set_flag(&q->sk, SOCK_ZEROCOPY);

		sock_set_flag(&q->sk, SOCK_ZEROCOPY);





	err = -ENOMEM;

	if (skb_array_init(&q->skb_array, tap->dev->tx_queue_len, GFP_KERNEL))

		goto err_array;



	err = tap_set_queue(tap, file, q);

	err = tap_set_queue(tap, file, q);

	if (err)

	if (err) {

		goto err_queue;

		/* tap_sock_destruct() will take care of freeing skb_array */

		goto err_put;

	}





	dev_put(tap->dev);

	dev_put(tap->dev);





	rtnl_unlock();

	rtnl_unlock();

	return err;

	return err;





err_queue:

err_put:

	skb_array_cleanup(&q->skb_array);

err_array:

	sock_put(&q->sk);

	sock_put(&q->sk);

err:

err:

	if (tap)

	if (tap)