diff options
| author | Fedor Pchelkin <pchelkin@ispras.ru> | 2023-06-13 22:22:20 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2023-06-15 11:41:01 +0100 |
| commit | 0c0cf3db83f8c7c9bb141c2771a34043bcf952ef (patch) | |
| tree | b42a85ec86993959f8beef2318548b2b242a97aa /net/tipc | |
| parent | 9eed321cde22fc1afd76eac563ce19d899e0d6b2 (diff) | |
| download | linux-0c0cf3db83f8c7c9bb141c2771a34043bcf952ef.tar.gz linux-0c0cf3db83f8c7c9bb141c2771a34043bcf952ef.tar.bz2 linux-0c0cf3db83f8c7c9bb141c2771a34043bcf952ef.zip | |
net: macsec: fix double free of percpu stats
Inside macsec_add_dev() we free percpu macsec->secy.tx_sc.stats and
macsec->stats on some of the memory allocation failure paths. However, the
net_device is already registered to that moment: in macsec_newlink(), just
before calling macsec_add_dev(). This means that during unregister process
its priv_destructor - macsec_free_netdev() - will be called and will free
the stats again.
Remove freeing percpu stats inside macsec_add_dev() because
macsec_free_netdev() will correctly free the already allocated ones. The
pointers to unallocated stats stay NULL, and free_percpu() treats that
correctly.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Fixes: 0a28bfd4971f ("net/macsec: Add MACsec skb_metadata_dst Tx Data path support")
Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver")
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/tipc')
0 files changed, 0 insertions, 0 deletions