diff options
| author | Jouni Hogander <jouni.hogander@unikie.com> | 2019-11-13 12:08:01 +0200 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2020-06-11 19:05:35 +0100 |
| commit | ff41ac4dd357b10010949dc50e640c9eb5d5f052 (patch) | |
| tree | f29a59bd3972f151c778e54e09e075749eed5bc7 | |
| parent | babf7e4a11200d94219dcebd64f50e6304bbde2e (diff) | |
| download | linux-stable-ff41ac4dd357b10010949dc50e640c9eb5d5f052.tar.gz | |
slcan: Fix memory leak in error path
commit ed50e1600b4483c049ce76e6bd3b665a6a9300ed upstream.
This patch is fixing memory leak reported by Syzkaller:
BUG: memory leak unreferenced object 0xffff888067f65500 (size 4096):
comm "syz-executor043", pid 454, jiffies 4294759719 (age 11.930s)
hex dump (first 32 bytes):
73 6c 63 61 6e 30 00 00 00 00 00 00 00 00 00 00 slcan0..........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000a06eec0d>] __kmalloc+0x18b/0x2c0
[<0000000083306e66>] kvmalloc_node+0x3a/0xc0
[<000000006ac27f87>] alloc_netdev_mqs+0x17a/0x1080
[<0000000061a996c9>] slcan_open+0x3ae/0x9a0
[<000000001226f0f9>] tty_ldisc_open.isra.1+0x76/0xc0
[<0000000019289631>] tty_set_ldisc+0x28c/0x5f0
[<000000004de5a617>] tty_ioctl+0x48d/0x1590
[<00000000daef496f>] do_vfs_ioctl+0x1c7/0x1510
[<0000000059068dbc>] ksys_ioctl+0x99/0xb0
[<000000009a6eb334>] __x64_sys_ioctl+0x78/0xb0
[<0000000053d0332e>] do_syscall_64+0x16f/0x580
[<0000000021b83b99>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[<000000008ea75434>] 0xffffffffffffffff
Cc: Wolfgang Grandegger <wg@grandegger.com>
Cc: Marc Kleine-Budde <mkl@pengutronix.de>
Cc: Lukas Bulwahn <lukas.bulwahn@gmail.com>
Signed-off-by: Jouni Hogander <jouni.hogander@unikie.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
| -rw-r--r-- | drivers/net/can/slcan.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c index f0769ce11c4b47..d15a07aa38d1c3 100644 --- a/drivers/net/can/slcan.c +++ b/drivers/net/can/slcan.c @@ -620,6 +620,7 @@ err_free_chan: sl->tty = NULL; tty->disc_data = NULL; clear_bit(SLF_INUSE, &sl->flags); + free_netdev(sl->dev); err_exit: rtnl_unlock(); |