On 2020/6/9 9:50, liaichun wrote:

From: LiAichun liaichun@huawei.com

From: YueHaibing yuehaibing@huawei.com

mainline inclusion from mainline-4.19.90-2003.4.0

mainline 后面是这个 patch 对应的版本号。

你找到主线中这个 pathc，看看 commit 属于哪个版本。

git name-rev --tags xxxxxxxx

xxxxx 是你找到的那个 commit

commit a91b7a28e76a702bd81357bf41a45dab6486716b

这个 commit 是哪里的，我怎么找不到

category:bugfix bugzilla:NA CVE:NA

---

From:YueHaibing<> Subject: [PATCH] netdevsim: Fix error handling in nsim_fib_init and neim_fib_exit Date: Mon, 8 Jun 2020 15:13:40 +0800

In nsim_fib_init(),if register_fib_notifier failed,nsim_fib_net_ops should be unregistered before return;

In nsim_fib_exit(),unregister_fib_notifier should be called before nsim_fib_net_ops be unregistered, otherwise may cause use-after-free

More detailed information can refer to: https://lkml.org/lkml/2019/10/11/216

Reported-by:Hulk Robot hulkci@huawei.com Fixes: 59c84b9fcf42("netdevsim: Restore per-network namespace accounting for fib entries") Signed-off-by: YueHaibing yuehaibing@huawei.com Signed-off-by: LiAichun liaichun@huawei.com

---

drivers/net/netdevsim/fib.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/netdevsim/fib.c b/drivers/net/netdevsim/fib.c index f61d094..d5c01b8 100644 --- a/drivers/net/netdevsim/fib.c +++ b/drivers/net/netdevsim/fib.c @@ -241,8 +241,8 @@ static int __net_init nsim_fib_netns_init(struct net *net)

void nsim_fib_exit(void) {

• unregister_pernet_subsys(&nsim_fib_net_ops); unregister_fib_notifier(&nsim_fib_nb);

• unregister_pernet_subsys(&nsim_fib_net_ops);

}

int nsim_fib_init(void) @@ -257,6 +257,7 @@ int nsim_fib_init(void)

err = register_fib_notifier(&nsim_fib_nb, nsim_fib_dump_inconsistent); if (err < 0) {

• unregister_pernet_subsys(&nsim_fib_net_ops);
  

  pr_err("Failed to register fib notifier\n"); goto err_out; }