Patch "net: macsec: fix double free of percpu stats" has been added to the 6.3-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    net: macsec: fix double free of percpu stats

to the 6.3-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net-macsec-fix-double-free-of-percpu-stats.patch
and it can be found in the queue-6.3 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 9ae6ab7fb80b3ceeb5746656a45e907e65773009
Author: Fedor Pchelkin <pchelkin@xxxxxxxxx>
Date:   Tue Jun 13 22:22:20 2023 +0300

    net: macsec: fix double free of percpu stats
    
    [ Upstream commit 0c0cf3db83f8c7c9bb141c2771a34043bcf952ef ]
    
    Inside macsec_add_dev() we free percpu macsec->secy.tx_sc.stats and
    macsec->stats on some of the memory allocation failure paths. However, the
    net_device is already registered to that moment: in macsec_newlink(), just
    before calling macsec_add_dev(). This means that during unregister process
    its priv_destructor - macsec_free_netdev() - will be called and will free
    the stats again.
    
    Remove freeing percpu stats inside macsec_add_dev() because
    macsec_free_netdev() will correctly free the already allocated ones. The
    pointers to unallocated stats stay NULL, and free_percpu() treats that
    correctly.
    
    Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
    
    Fixes: 0a28bfd4971f ("net/macsec: Add MACsec skb_metadata_dst Tx Data path support")
    Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver")
    Signed-off-by: Fedor Pchelkin <pchelkin@xxxxxxxxx>
    Reviewed-by: Sabrina Dubroca <sd@xxxxxxxxxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
index 25616247d7a56..e040c191659b9 100644
--- a/drivers/net/macsec.c
+++ b/drivers/net/macsec.c
@@ -3987,17 +3987,15 @@ static int macsec_add_dev(struct net_device *dev, sci_t sci, u8 icv_len)
 		return -ENOMEM;
 
 	secy->tx_sc.stats = netdev_alloc_pcpu_stats(struct pcpu_tx_sc_stats);
-	if (!secy->tx_sc.stats) {
-		free_percpu(macsec->stats);
+	if (!secy->tx_sc.stats)
 		return -ENOMEM;
-	}
 
 	secy->tx_sc.md_dst = metadata_dst_alloc(0, METADATA_MACSEC, GFP_KERNEL);
-	if (!secy->tx_sc.md_dst) {
-		free_percpu(secy->tx_sc.stats);
-		free_percpu(macsec->stats);
+	if (!secy->tx_sc.md_dst)
+		/* macsec and secy percpu stats will be freed when unregistering
+		 * net_device in macsec_free_netdev()
+		 */
 		return -ENOMEM;
-	}
 
 	if (sci == MACSEC_UNDEF_SCI)
 		sci = dev_to_sci(dev, MACSEC_PORT_ES);



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux