Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ab3ec512 authored by Ben Hutchings's avatar Ben Hutchings Committed by Greg Kroah-Hartman
Browse files

slcan: Fix double-free on slcan_open() error path 



Commit 9ebd796e2400 ("can: slcan: Fix use-after-free Read in
slcan_open") was incorrectly backported to 4.4 and 4.9 stable
branches.

Since they do not have commit cf124db566e6 ("net: Fix inconsistent
teardown and release of private netdev state."), the destructor
function slc_free_netdev() is already responsible for calling
free_netdev() and slcan_open() must not call both of them.

yangerkun previously fixed the same bug in slip.

Fixes: ce624b20 ("can: slcan: Fix use-after-free Read in slcan_open") # 4.4
Fixes: f59604a8 ("slcan: not call free_netdev before rtnl_unlock ...") # 4.4
Fixes: 56635a1e6ffb ("can: slcan: Fix use-after-free Read in slcan_open") # 4.9
Fixes: a1c9b23142ac ("slcan: not call free_netdev before rtnl_unlock ...") # 4.9
Cc: yangerkun <yangerkun@huawei.com>
Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 69970700

drivers/net/can/slcan.c

+1 −2
Original line number Diff line number Diff line
@@ -618,10 +618,9 @@ err_free_chan: 
	sl->tty = NULL;

	tty->disc_data = NULL;

	clear_bit(SLF_INUSE, &sl->flags);

	slc_free_netdev(sl->dev);

	/* do not call free_netdev before rtnl_unlock */

	rtnl_unlock();

	free_netdev(sl->dev);

	slc_free_netdev(sl->dev);

	return err;



err_exit: