diff options
| author | David S. Miller <davem@davemloft.net> | 2021-06-25 00:39:59 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2021-06-25 00:39:59 +0200 |
| commit | 8bead5c2a2551ffb66a1c5a8d9356e55420ed095 (patch) | |
| tree | 8f4c793b48504f8980456e09332c3da3c851c270 | |
| parent | e1000e: Check the PCIm state (diff) | |
| parent | ieee802154: hwsim: avoid possible crash in hwsim_del_edge_nl() (diff) | |
| download | linux-8bead5c2a2551ffb66a1c5a8d9356e55420ed095.tar.xz linux-8bead5c2a2551ffb66a1c5a8d9356e55420ed095.zip | |
Merge tag 'ieee802154-for-davem-2021-06-24' of git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan
Stefan Schmidt says:
====================
pull-request: ieee802154 for net 2021-06-24
An update from ieee802154 for your *net* tree.
This time we only have fixes for ieee802154 hwsim driver.
Sparked from some syzcaller reports We got a potential
crash fix from Eric Dumazet and two memory leak fixes from
Dongliang Mu.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | drivers/net/ieee802154/mac802154_hwsim.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/drivers/net/ieee802154/mac802154_hwsim.c b/drivers/net/ieee802154/mac802154_hwsim.c index da9135231c07..ebc976b7fcc2 100644 --- a/drivers/net/ieee802154/mac802154_hwsim.c +++ b/drivers/net/ieee802154/mac802154_hwsim.c @@ -480,7 +480,7 @@ static int hwsim_del_edge_nl(struct sk_buff *msg, struct genl_info *info) struct hwsim_edge *e; u32 v0, v1; - if (!info->attrs[MAC802154_HWSIM_ATTR_RADIO_ID] && + if (!info->attrs[MAC802154_HWSIM_ATTR_RADIO_ID] || !info->attrs[MAC802154_HWSIM_ATTR_RADIO_EDGE]) return -EINVAL; @@ -715,6 +715,8 @@ static int hwsim_subscribe_all_others(struct hwsim_phy *phy) return 0; +sub_fail: + hwsim_edge_unsubscribe_me(phy); me_fail: rcu_read_lock(); list_for_each_entry_rcu(e, &phy->edges, list) { @@ -722,8 +724,6 @@ me_fail: hwsim_free_edge(e); } rcu_read_unlock(); -sub_fail: - hwsim_edge_unsubscribe_me(phy); return -ENOMEM; } @@ -824,12 +824,17 @@ err_pib: static void hwsim_del(struct hwsim_phy *phy) { struct hwsim_pib *pib; + struct hwsim_edge *e; hwsim_edge_unsubscribe_me(phy); list_del(&phy->list); rcu_read_lock(); + list_for_each_entry_rcu(e, &phy->edges, list) { + list_del_rcu(&e->list); + hwsim_free_edge(e); + } pib = rcu_dereference(phy->pib); rcu_read_unlock(); |