um: vector: Fix exception handling in vector_eth_configure()

[PATCH v4] um: vector: Fix exception handling in vector_eth_configure()

Posted by Minjie Du 2 years, 7 months ago

The resource cleanup was incomplete in the implementation 
of the function "vector_eth_configure".
Thus replace the jump target
"out_undo_user_init" by "out_free_netdev".
Delate the orphan function "out_undo_user_init"

PATCH v1-v3: Modify the patch format.

Signed-off-by: Minjie Du <duminjie@vivo.com>
---
 arch/um/drivers/vector_kern.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/arch/um/drivers/vector_kern.c b/arch/um/drivers/vector_kern.c
index 131b7cb29..7ae6ab8df 100644
--- a/arch/um/drivers/vector_kern.c
+++ b/arch/um/drivers/vector_kern.c
@@ -1646,7 +1646,7 @@ static void vector_eth_configure(
 	err = register_netdevice(dev);
 	rtnl_unlock();
 	if (err)
-		goto out_undo_user_init;
+		goto out_free_netdev;
 
 	spin_lock(&vector_devices_lock);
 	list_add(&device->list, &vector_devices);
@@ -1654,8 +1654,6 @@ static void vector_eth_configure(
 
 	return;
 
-out_undo_user_init:
-	return;
 out_free_netdev:
 	free_netdev(dev);
 out_free_device:
-- 
2.39.0

Re: [PATCH v4] um: vector: Fix exception handling in vector_eth_configure()

Posted by Richard Weinberger 2 years, 5 months ago

----- Ursprüngliche Mail -----
> The resource cleanup was incomplete in the implementation
> of the function "vector_eth_configure".
> Thus replace the jump target
> "out_undo_user_init" by "out_free_netdev".
> Delate the orphan function "out_undo_user_init"
> 
> PATCH v1-v3: Modify the patch format.
> 
> Signed-off-by: Minjie Du <duminjie@vivo.com>
> ---
> arch/um/drivers/vector_kern.c | 4 +---
> 1 file changed, 1 insertion(+), 3 deletions(-)
> 
> diff --git a/arch/um/drivers/vector_kern.c b/arch/um/drivers/vector_kern.c
> index 131b7cb29..7ae6ab8df 100644
> --- a/arch/um/drivers/vector_kern.c
> +++ b/arch/um/drivers/vector_kern.c
> @@ -1646,7 +1646,7 @@ static void vector_eth_configure(
> 	err = register_netdevice(dev);
> 	rtnl_unlock();
> 	if (err)
> -		goto out_undo_user_init;
> +		goto out_free_netdev;
> 
> 	spin_lock(&vector_devices_lock);
> 	list_add(&device->list, &vector_devices);
> @@ -1654,8 +1654,6 @@ static void vector_eth_configure(
> 
> 	return;
> 
> -out_undo_user_init:
> -	return;

I don't think this is correct.
vector_eth_configure() cannot communicate the failure since it is of type void.
So, vector_remove() will run and will call unregister_netdev(). That can cause a double-free.

Thanks,
//richard

Re: [PATCH v4] um: vector: Fix exception handling in vector_eth_configure()

Posted by Anton Ivanov 2 years, 5 months ago

On 19/08/2023 22:01, Richard Weinberger wrote:
> ----- Ursprüngliche Mail -----
>> The resource cleanup was incomplete in the implementation
>> of the function "vector_eth_configure".
>> Thus replace the jump target
>> "out_undo_user_init" by "out_free_netdev".
>> Delate the orphan function "out_undo_user_init"
>>
>> PATCH v1-v3: Modify the patch format.
>>
>> Signed-off-by: Minjie Du <duminjie@vivo.com>
>> ---
>> arch/um/drivers/vector_kern.c | 4 +---
>> 1 file changed, 1 insertion(+), 3 deletions(-)
>>
>> diff --git a/arch/um/drivers/vector_kern.c b/arch/um/drivers/vector_kern.c
>> index 131b7cb29..7ae6ab8df 100644
>> --- a/arch/um/drivers/vector_kern.c
>> +++ b/arch/um/drivers/vector_kern.c
>> @@ -1646,7 +1646,7 @@ static void vector_eth_configure(
>> 	err = register_netdevice(dev);
>> 	rtnl_unlock();
>> 	if (err)
>> -		goto out_undo_user_init;
>> +		goto out_free_netdev;
>>
>> 	spin_lock(&vector_devices_lock);
>> 	list_add(&device->list, &vector_devices);
>> @@ -1654,8 +1654,6 @@ static void vector_eth_configure(
>>
>> 	return;
>>
>> -out_undo_user_init:
>> -	return;
> 
> I don't think this is correct.
> vector_eth_configure() cannot communicate the failure since it is of type void.
> So, vector_remove() will run and will call unregister_netdev(). That can cause a double-free.

vector_remove() will be called only once per device. It checks if the 
device is in the device list and if it is not - bails. If it is in the 
list it removes it from there and calls unregister_netdev() after that.

So, unless I am missing something, there is no harm here - unregister 
will not be called for a device that failed to register, because the 
list is updated only if the device has registered successfully.

However, on second read - if register fails, the current code leaks a 
*device which was alloc-ed in the beginning of configure. So even if we 
skip free_netdev, which invokes remove we still need to free that *device.

> 
> Thanks,
> //richard
> 

-- 
Anton R. Ivanov
Cambridgegreys Limited. Registered in England. Company Number 10273661
https://www.cambridgegreys.com/