[PATCH] media: dvb-core: release the net slot when adding an interface fails

[YuanZhe Liu]

dvb_net_add_if() reserves a slot with get_if(), which sets
dvbnet->state[if_num] before the netdev exists.  If alloc_netdev() or
register_netdev() then fails, the slot keeps state set while
dvbnet->device[if_num] is cleared, and the interface is never announced
as created.

A later NET_GET_IF or __NET_GET_IF_OLD request for that slot passes the
state check in dvb_net_do_ioctl() and dereferences the NULL netdev
through netdev_priv(), which raises a general protection fault:

  KASAN: null-ptr-deref in range [0x0000000000000980-0x0000000000000987]
  RIP: dvb_net_do_ioctl+0x4f8/0x710

Return the slot to the free pool on both failure paths so that state and
device can no longer disagree.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@xxxxxxxxxxxxxxx
Co-developed-by: Bin Yu <byu@xxxxxxxxxxxxx>
Signed-off-by: Bin Yu <byu@xxxxxxxxxxxxx>
Co-developed-by: Cheng Wen <wencheng@xxxxxxxxxxxxx>
Signed-off-by: Cheng Wen <wencheng@xxxxxxxxxxxxx>
Signed-off-by: YuanZhe Liu <25031212351@xxxxxxxxxxxxxxxxx>
---
 drivers/media/dvb-core/dvb_net.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/media/dvb-core/dvb_net.c b/drivers/media/dvb-core/dvb_net.c
index a2159b2bc176..912841f7cd55 100644
--- a/drivers/media/dvb-core/dvb_net.c
+++ b/drivers/media/dvb-core/dvb_net.c
@@ -1358,8 +1358,10 @@ static int dvb_net_add_if(struct dvb_net *dvbnet, u16 pid, u8 feedtype)
 
 	net = alloc_netdev(sizeof(struct dvb_net_priv), "dvb",
 			   NET_NAME_UNKNOWN, dvb_net_setup);
-	if (!net)
+	if (!net) {
+		dvbnet->state[if_num] = 0;
 		return -ENOMEM;
+	}
 
 	if (dvbnet->dvbdev->id)
 		snprintf(net->name, IFNAMSIZ, "dvb%d%u%d",
@@ -1392,6 +1394,7 @@ static int dvb_net_add_if(struct dvb_net *dvbnet, u16 pid, u8 feedtype)
 
 	if ((result = register_netdev(net)) < 0) {
 		dvbnet->device[if_num] = NULL;
+		dvbnet->state[if_num] = 0;
 		free_netdev(net);
 		return result;
 	}
-- 
2.34.1