From patchwork Fri Apr 5 10:47:34 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Patryk Mungai X-Patchwork-Id: 10887159 X-Patchwork-Delegate: pavel@denx.de Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 727941390 for ; Fri, 5 Apr 2019 10:53:54 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 5B6512872A for ; Fri, 5 Apr 2019 10:53:54 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 4F97D2888E; Fri, 5 Apr 2019 10:53:54 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from mail.linuxfoundation.org (mail.linuxfoundation.org [140.211.169.12]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 4F17B2872A for ; Fri, 5 Apr 2019 10:53:53 +0000 (UTC) Received: from mail.linux-foundation.org (localhost [127.0.0.1]) by mail.linuxfoundation.org (Postfix) with ESMTP id A06C92356; Fri, 5 Apr 2019 10:53:50 +0000 (UTC) X-Original-To: cip-dev@lists.cip-project.org Delivered-To: cip-dev@mail.linuxfoundation.org Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id ED40B2354 for ; Fri, 5 Apr 2019 10:53:14 +0000 (UTC) X-Greylist: from auto-whitelisted by SQLgrey-1.7.6 Received: from relmlie5.idc.renesas.com (relmlor1.renesas.com [210.160.252.171]) by smtp1.linuxfoundation.org (Postfix) with ESMTP id 752EFFD for ; Fri, 5 Apr 2019 10:53:14 +0000 (UTC) X-IronPort-AV: E=Sophos;i="5.60,312,1549897200"; d="scan'208";a="12377579" Received: from unknown (HELO relmlir6.idc.renesas.com) ([10.200.68.152]) by relmlie5.idc.renesas.com with ESMTP; 05 Apr 2019 19:48:12 +0900 Received: from patryk-linuxbox.ree.adwin.renesas.com (unknown [10.226.36.164]) by relmlir6.idc.renesas.com (Postfix) with ESMTP id 2A5C340189DF; Fri, 5 Apr 2019 19:48:10 +0900 (JST) From: Patryk Mungai To: stable@vger.kernel.org Date: Fri, 5 Apr 2019 11:47:34 +0100 Message-Id: <1554461256-12966-4-git-send-email-patryk.mungai-ndungu.kx@renesas.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1554461256-12966-1-git-send-email-patryk.mungai-ndungu.kx@renesas.com> References: <1554461256-12966-1-git-send-email-patryk.mungai-ndungu.kx@renesas.com> MIME-Version: 1.0 Cc: davem@davemloft.net, cip-dev@lists.cip-project.org, =?utf-8?q?Uwe_Kleine?= =?utf-8?q?-K=C3=B6nig?= Subject: [cip-dev] [PATCH 4.4 3/5] net: ipconfig: fix use after free X-BeenThere: cip-dev@lists.cip-project.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: cip-dev-bounces@lists.cip-project.org Errors-To: cip-dev-bounces@lists.cip-project.org X-Virus-Scanned: ClamAV using ClamSMTP From: Uwe Kleine-König commit 9c706a49d660653625d206f6972541c1f60ea2b0 upstream. ic_close_devs() calls kfree() for all devices's ic_device. Since commit 2647cffb2bc6 ("net: ipconfig: Support using "delayed" DHCP replies") the active device's ic_device is still used however to print the ipconfig summary which results in an oops if the memory is already changed. So delay freeing until after the autoconfig results are reported. Fixes: 2647cffb2bc6 ("net: ipconfig: Support using "delayed" DHCP replies") Reported-by: Geert Uytterhoeven Signed-off-by: Uwe Kleine-König Tested-by: Geert Uytterhoeven Signed-off-by: David S. Miller [Patryk: cherry-picked to 4.4] Signed-off-by: Patryk Mungai --- net/ipv4/ipconfig.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c index 35c8b35..23c9b8a 100644 --- a/net/ipv4/ipconfig.c +++ b/net/ipv4/ipconfig.c @@ -1519,14 +1519,6 @@ static int __init ip_auto_config(void) return -1; /* - * Close all network devices except the device we've - * autoconfigured and set up routes. - */ - ic_close_devs(); - if (ic_setup_if() < 0 || ic_setup_routes() < 0) - return -1; - - /* * Record which protocol was actually used. */ #ifdef IPCONFIG_DYNAMIC @@ -1560,6 +1552,15 @@ static int __init ip_auto_config(void) pr_cont("\n"); #endif /* !SILENT */ + /* + * Close all network devices except the device we've + * autoconfigured and set up routes. + */ + ic_close_devs(); + if (ic_setup_if() < 0 || ic_setup_routes() < 0) + return -1; + + return 0; }