diff mbox series

[net,v2] netdevsim: fix unbalaced locking in nsim_create()

Message ID 20200721145150.25964-1-ap420073@gmail.com
State Accepted
Delegated to: David Miller
Headers show
Series [net,v2] netdevsim: fix unbalaced locking in nsim_create() | expand

Commit Message

Taehee Yoo July 21, 2020, 2:51 p.m. UTC
In the nsim_create(), rtnl_lock() is called before nsim_bpf_init().
If nsim_bpf_init() is failed, rtnl_unlock() should be called,
but it isn't called.
So, unbalanced locking would occur.

Fixes: e05b2d141fef ("netdevsim: move netdev creation/destruction to dev probe")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
---

v1->v2:
 - Change error path label name.

 drivers/net/netdevsim/netdev.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Comments

Jakub Kicinski July 21, 2020, 7:27 p.m. UTC | #1
On Tue, 21 Jul 2020 14:51:50 +0000 Taehee Yoo wrote:
> In the nsim_create(), rtnl_lock() is called before nsim_bpf_init().
> If nsim_bpf_init() is failed, rtnl_unlock() should be called,
> but it isn't called.
> So, unbalanced locking would occur.
> 
> Fixes: e05b2d141fef ("netdevsim: move netdev creation/destruction to dev probe")
> Signed-off-by: Taehee Yoo <ap420073@gmail.com>

Reviewed-by: Jakub Kicinski <kuba@kernel.org>

Thanks!
David Miller July 21, 2020, 11:09 p.m. UTC | #2
From: Taehee Yoo <ap420073@gmail.com>
Date: Tue, 21 Jul 2020 14:51:50 +0000

> In the nsim_create(), rtnl_lock() is called before nsim_bpf_init().
> If nsim_bpf_init() is failed, rtnl_unlock() should be called,
> but it isn't called.
> So, unbalanced locking would occur.
> 
> Fixes: e05b2d141fef ("netdevsim: move netdev creation/destruction to dev probe")
> Signed-off-by: Taehee Yoo <ap420073@gmail.com>

Applied and queued up for -stable, thank you.
diff mbox series

Patch

diff --git a/drivers/net/netdevsim/netdev.c b/drivers/net/netdevsim/netdev.c
index 2908e0a0d6e1..23950e7a0f81 100644
--- a/drivers/net/netdevsim/netdev.c
+++ b/drivers/net/netdevsim/netdev.c
@@ -302,7 +302,7 @@  nsim_create(struct nsim_dev *nsim_dev, struct nsim_dev_port *nsim_dev_port)
 	rtnl_lock();
 	err = nsim_bpf_init(ns);
 	if (err)
-		goto err_free_netdev;
+		goto err_rtnl_unlock;
 
 	nsim_ipsec_init(ns);
 
@@ -316,8 +316,8 @@  nsim_create(struct nsim_dev *nsim_dev, struct nsim_dev_port *nsim_dev_port)
 err_ipsec_teardown:
 	nsim_ipsec_teardown(ns);
 	nsim_bpf_uninit(ns);
+err_rtnl_unlock:
 	rtnl_unlock();
-err_free_netdev:
 	free_netdev(dev);
 	return ERR_PTR(err);
 }