On Fri, Feb 28, 2020 at 09:40:48PM +0800, yangerkun wrote:
> After include 3b5a39979daf ("slip: Fix memory leak in slip_open error path")
> and e58c19124189 ("slip: Fix use-after-free Read in slip_open") with 4.4.y/4.9.y.
> We will trigger a bug since we can double free sl->dev in slip_open. Actually,
> we should backport cf124db566e6 ("net: Fix inconsistent teardown and release
> of private netdev state.") too since it has delete free_netdev from sl_free_netdev.
> Fix it by delete free_netdev from slip_open.
>
> Signed-off-by: yangerkun <yangerkun@xxxxxxxxxx>
> ---
> drivers/net/slip/slip.c | 1 -
> 1 file changed, 1 deletion(-)
>
> diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c
> index 0f8d5609ed51..d4a33baa33b6 100644
> --- a/drivers/net/slip/slip.c
> +++ b/drivers/net/slip/slip.c
> @@ -868,7 +868,6 @@ err_free_chan:
> tty->disc_data = NULL;
> clear_bit(SLF_INUSE, &sl->flags);
> sl_free_netdev(sl->dev);
> - free_netdev(sl->dev);
Thanks for this, now queued up.
greg k-h
