Jouni Hogander
b4272b0f82
slip: Fix memory leak in slip_open error path
[ Upstream commit 3b5a39979dafea9d0cd69c7ae06088f7a84cdafa ]
Driver/net/can/slcan.c is derived from slip.c. Memory leak was detected
by Syzkaller in slcan. Same issue exists in slip.c and this patch is
addressing the leak in slip.c.
Here is the slcan memory leak trace reported by Syzkaller:
BUG: memory leak unreferenced object 0xffff888067f65500 (size 4096):
comm "syz-executor043", pid 454, jiffies 4294759719 (age 11.930s)
hex dump (first 32 bytes):
73 6c 63 61 6e 30 00 00 00 00 00 00 00 00 00 00 slcan0..........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000a06eec0d>] __kmalloc+0x18b/0x2c0
[<0000000083306e66>] kvmalloc_node+0x3a/0xc0
[<000000006ac27f87>] alloc_netdev_mqs+0x17a/0x1080
[<0000000061a996c9>] slcan_open+0x3ae/0x9a0
[<000000001226f0f9>] tty_ldisc_open.isra.1+0x76/0xc0
[<0000000019289631>] tty_set_ldisc+0x28c/0x5f0
[<000000004de5a617>] tty_ioctl+0x48d/0x1590
[<00000000daef496f>] do_vfs_ioctl+0x1c7/0x1510
[<0000000059068dbc>] ksys_ioctl+0x99/0xb0
[<000000009a6eb334>] __x64_sys_ioctl+0x78/0xb0
[<0000000053d0332e>] do_syscall_64+0x16f/0x580
[<0000000021b83b99>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[<000000008ea75434>] 0xfffffffffffffff
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Oliver Hartkopp <socketcan@hartkopp.net>
Cc: Lukas Bulwahn <lukas.bulwahn@gmail.com>
Signed-off-by: Jouni Hogander <jouni.hogander@unikie.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
2019-11-25 09:51:54 +01:00 |
| .. |
|
appletalk
|
net/appletalk: fix minor pointer leak to userspace in SIOCFINDIPDDPRT
|
2018-09-29 03:07:32 -07:00 |
|
arcnet
|
arcnet: provide a buffer big enough to actually receive packets
|
2019-10-05 12:30:12 +02:00 |
|
bonding
|
bonding: fix unexpected IFF_BONDING bit unset
|
2019-11-12 19:15:58 +01:00 |
|
caif
|
caif-hsi: fix possible deadlock in cfhsi_exit_module()
|
2019-08-04 09:33:33 +02:00 |
|
can
|
can: flexcan: disable completely the ECC mechanism
|
2019-11-12 19:16:10 +01:00 |
|
cris
|
|
|
|
dsa
|
net: dsa: mv88e6xxx: wait after reset deactivation
|
2019-08-04 09:33:33 +02:00 |
|
ethernet
|
e1000: fix memory leaks
|
2019-11-12 19:16:07 +01:00 |
|
fddi
|
|
|
|
fjes
|
fjes: Handle workqueue allocation failure
|
2019-11-12 19:16:04 +01:00 |
|
hamradio
|
net: hamradio: use eth_broadcast_addr
|
2018-08-24 13:12:30 +02:00 |
|
hippi
|
hippi: Fix a Fix a possible sleep-in-atomic bug in rr_close
|
2018-02-25 11:05:50 +01:00 |
|
hyperv
|
hv_netvsc: Fix IP header checksum for coalesced packets
|
2019-03-13 14:04:53 -07:00 |
|
ieee802154
|
ieee802154: atusb: fix use-after-free at disconnect
|
2019-10-17 13:42:07 -07:00 |
|
ipvlan
|
ipvlan: disallow userns cap_net_admin to change global mode/flags
|
2019-03-19 13:14:10 +01:00 |
|
irda
|
irda: vlsi_ir: fix check for DMA mapping errors
|
2017-12-25 14:23:41 +01:00 |
|
phy
|
net/phy: fix DP83865 10 Mbps HDX loopback disable function
|
2019-10-05 12:30:13 +02:00 |
|
plip
|
|
|
|
ppp
|
ppp: Fix memory leak in ppp_write
|
2019-10-05 12:30:13 +02:00 |
|
slip
|
slip: Fix memory leak in slip_open error path
|
2019-11-25 09:51:54 +01:00 |
|
team
|
team: Add vlan tx offload to hw_enc_features
|
2019-08-25 10:51:52 +02:00 |
|
usb
|
ax88172a: fix information leak on short answers
|
2019-11-25 09:51:53 +01:00 |
|
vmxnet3
|
vmxnet3: use DMA memory barriers where required
|
2018-05-25 16:12:56 +02:00 |
|
wan
|
net/wan: fix a double free in x25_asy_open_tty()
|
2019-01-09 16:16:40 +01:00 |
|
wimax
|
wimax/i2400m: fix a memory leak bug
|
2019-09-10 10:31:01 +01:00 |
|
wireless
|
rtlwifi: Fix potential overflow on P2P code
|
2019-11-06 12:18:22 +01:00 |
|
xen-netback
|
xen/netback: fix error path of xenvif_connect_data()
|
2019-10-29 09:15:26 +01:00 |
|
dummy.c
|
|
|
|
eql.c
|
|
|
|
geneve.c
|
geneve: add missing rx stats accounting
|
2018-04-13 19:48:26 +02:00 |
|
gtp.c
|
gtp: fix use-after-free in gtp_newlink()
|
2019-08-04 09:33:25 +02:00 |
|
ifb.c
|
|
|
|
Kconfig
|
vmxnet3: prevent building with 64K pages
|
2018-02-25 11:05:51 +01:00 |
|
LICENSE.SRC
|
|
|
|
loopback.c
|
|
|
|
macsec.c
|
macsec: drop skb sk before calling gro_cells_receive
|
2019-10-05 12:30:12 +02:00 |
|
macvlan.c
|
macvlan: fix use-after-free in macvlan_common_newlink()
|
2018-05-30 07:50:30 +02:00 |
|
macvtap.c
|
tap: double-free in error path in tap_open()
|
2017-11-18 11:22:22 +01:00 |
|
Makefile
|
|
|
|
mdio.c
|
|
|
|
mii.c
|
|
|
|
netconsole.c
|
|
|
|
nlmon.c
|
|
|
|
ntb_netdev.c
|
|
|
|
rionet.c
|
rapidio/rionet: do not free skb before reading its length
|
2018-12-05 19:42:38 +01:00 |
|
sb1000.c
|
|
|
|
Space.c
|
|
|
|
sungem_phy.c
|
|
|
|
tun.c
|
tun: fix use-after-free when register netdev failed
|
2019-09-21 07:14:03 +02:00 |
|
veth.c
|
veth: set peer GSO values
|
2018-03-22 09:17:57 +01:00 |
|
virtio_net.c
|
virtio-net: Fix operstate for virtio when no VIRTIO_NET_F_STATUS
|
2018-05-30 07:50:44 +02:00 |
|
vrf.c
|
vrf: make sure skb->data contains ip header to make routing
|
2019-08-04 09:33:34 +02:00 |
|
vxlan.c
|
vxlan: check tun_info options_len properly
|
2019-11-10 11:23:28 +01:00 |
|
xen-netfront.c
|
xen-netfront: do not use ~0U as error return value for xennet_fill_frags()
|
2019-10-07 18:53:23 +02:00 |