| Message ID | 53925353450dea9a705d67ad225b589e8508042c.1715002910.git.duoming@zju.edu.cn (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | ax25: Fix issues of ax25_dev and net_device | expand |
… > Replace it with a ax25_dev_put() call instead. … > --- > Changes in v3: > - Make commit messages more clearer. … > +++ b/net/ax25/ax25_dev.c > @@ -188,16 +188,13 @@ struct net_device *ax25_fwd_dev(struct net_device *dev) > */ > void __exit ax25_dev_free(void) > { … > - ax25_dev = ax25_dev_list; > - while (ax25_dev != NULL) { > - s = ax25_dev; > - netdev_put(ax25_dev->dev, &ax25_dev->dev_tracker); > - ax25_dev = ax25_dev->next; > - kfree(s); > + list_for_each_entry_safe(s, n, &ax25_dev_list, list) { > + netdev_put(s->dev, &s->dev_tracker); > + list_del(&s->list); > + ax25_dev_put(s); > } > - ax25_dev_list = NULL; … Can the increased application of the Linux list API be offered as a separate update step? https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v6.9-rc7#n81 Regards, Markus
diff --git a/net/ax25/ax25_dev.c b/net/ax25/ax25_dev.c index fbaaba0351e..8ee028e752f 100644 --- a/net/ax25/ax25_dev.c +++ b/net/ax25/ax25_dev.c @@ -188,16 +188,13 @@ struct net_device *ax25_fwd_dev(struct net_device *dev) */ void __exit ax25_dev_free(void) { - ax25_dev *s, *ax25_dev; + ax25_dev *s, *n; spin_lock_bh(&ax25_dev_lock); - ax25_dev = ax25_dev_list; - while (ax25_dev != NULL) { - s = ax25_dev; - netdev_put(ax25_dev->dev, &ax25_dev->dev_tracker); - ax25_dev = ax25_dev->next; - kfree(s); + list_for_each_entry_safe(s, n, &ax25_dev_list, list) { + netdev_put(s->dev, &s->dev_tracker); + list_del(&s->list); + ax25_dev_put(s); } - ax25_dev_list = NULL; spin_unlock_bh(&ax25_dev_lock); }
The object "ax25_dev" is managed by reference counting. Thus it should not be directly released by a kfree() call in ax25_dev_free(). Replace it with a ax25_dev_put() call instead. Fixes: d01ffb9eee4a ("ax25: add refcount in ax25_dev to avoid UAF bugs") Suggested-by: Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> --- Changes in v3: - Make commit messages more clearer. net/ax25/ax25_dev.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-)