]>
Commit | Line | Data |
---|---|---|
8cbcfc8d GKH |
1 | From foo@baz Fri Mar 15 21:00:09 PDT 2019 |
2 | From: Mao Wenan <maowenan@huawei.com> | |
3 | Date: Wed, 6 Mar 2019 22:45:01 +0800 | |
4 | Subject: net: hsr: fix memory leak in hsr_dev_finalize() | |
5 | ||
6 | From: Mao Wenan <maowenan@huawei.com> | |
7 | ||
ec5dda07 | 8 | [ Upstream commit 6caabe7f197d3466d238f70915d65301f1716626 ] |
8cbcfc8d GKH |
9 | |
10 | If hsr_add_port(hsr, hsr_dev, HSR_PT_MASTER) failed to | |
11 | add port, it directly returns res and forgets to free the node | |
12 | that allocated in hsr_create_self_node(), and forgets to delete | |
13 | the node->mac_list linked in hsr->self_node_db. | |
14 | ||
15 | BUG: memory leak | |
16 | unreferenced object 0xffff8881cfa0c780 (size 64): | |
17 | comm "syz-executor.0", pid 2077, jiffies 4294717969 (age 2415.377s) | |
18 | hex dump (first 32 bytes): | |
19 | e0 c7 a0 cf 81 88 ff ff 00 02 00 00 00 00 ad de ................ | |
20 | 00 e6 49 cd 81 88 ff ff c0 9b 87 d0 81 88 ff ff ..I............. | |
21 | backtrace: | |
22 | [<00000000e2ff5070>] hsr_dev_finalize+0x736/0x960 [hsr] | |
23 | [<000000003ed2e597>] hsr_newlink+0x2b2/0x3e0 [hsr] | |
24 | [<000000003fa8c6b6>] __rtnl_newlink+0xf1f/0x1600 net/core/rtnetlink.c:3182 | |
25 | [<000000001247a7ad>] rtnl_newlink+0x66/0x90 net/core/rtnetlink.c:3240 | |
26 | [<00000000e7d1b61d>] rtnetlink_rcv_msg+0x54e/0xb90 net/core/rtnetlink.c:5130 | |
27 | [<000000005556bd3a>] netlink_rcv_skb+0x129/0x340 net/netlink/af_netlink.c:2477 | |
28 | [<00000000741d5ee6>] netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline] | |
29 | [<00000000741d5ee6>] netlink_unicast+0x49a/0x650 net/netlink/af_netlink.c:1336 | |
30 | [<000000009d56f9b7>] netlink_sendmsg+0x88b/0xdf0 net/netlink/af_netlink.c:1917 | |
31 | [<0000000046b35c59>] sock_sendmsg_nosec net/socket.c:621 [inline] | |
32 | [<0000000046b35c59>] sock_sendmsg+0xc3/0x100 net/socket.c:631 | |
33 | [<00000000d208adc9>] __sys_sendto+0x33e/0x560 net/socket.c:1786 | |
34 | [<00000000b582837a>] __do_sys_sendto net/socket.c:1798 [inline] | |
35 | [<00000000b582837a>] __se_sys_sendto net/socket.c:1794 [inline] | |
36 | [<00000000b582837a>] __x64_sys_sendto+0xdd/0x1b0 net/socket.c:1794 | |
37 | [<00000000c866801d>] do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290 | |
38 | [<00000000fea382d9>] entry_SYSCALL_64_after_hwframe+0x49/0xbe | |
39 | [<00000000e01dacb3>] 0xffffffffffffffff | |
40 | ||
41 | Fixes: c5a759117210 ("net/hsr: Use list_head (and rcu) instead of array for slave devices.") | |
42 | Reported-by: Hulk Robot <hulkci@huawei.com> | |
43 | Signed-off-by: Mao Wenan <maowenan@huawei.com> | |
44 | Signed-off-by: David S. Miller <davem@davemloft.net> | |
45 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
46 | --- | |
47 | net/hsr/hsr_device.c | 4 +++- | |
48 | net/hsr/hsr_framereg.c | 12 ++++++++++++ | |
49 | net/hsr/hsr_framereg.h | 1 + | |
50 | 3 files changed, 16 insertions(+), 1 deletion(-) | |
51 | ||
52 | --- a/net/hsr/hsr_device.c | |
53 | +++ b/net/hsr/hsr_device.c | |
54 | @@ -485,7 +485,7 @@ int hsr_dev_finalize(struct net_device * | |
55 | ||
56 | res = hsr_add_port(hsr, hsr_dev, HSR_PT_MASTER); | |
57 | if (res) | |
58 | - return res; | |
59 | + goto err_add_port; | |
60 | ||
61 | res = register_netdevice(hsr_dev); | |
62 | if (res) | |
63 | @@ -505,6 +505,8 @@ int hsr_dev_finalize(struct net_device * | |
64 | fail: | |
65 | hsr_for_each_port(hsr, port) | |
66 | hsr_del_port(port); | |
67 | +err_add_port: | |
68 | + hsr_del_node(&hsr->self_node_db); | |
69 | ||
70 | return res; | |
71 | } | |
72 | --- a/net/hsr/hsr_framereg.c | |
73 | +++ b/net/hsr/hsr_framereg.c | |
74 | @@ -124,6 +124,18 @@ int hsr_create_self_node(struct list_hea | |
75 | return 0; | |
76 | } | |
77 | ||
78 | +void hsr_del_node(struct list_head *self_node_db) | |
79 | +{ | |
80 | + struct hsr_node *node; | |
81 | + | |
82 | + rcu_read_lock(); | |
83 | + node = list_first_or_null_rcu(self_node_db, struct hsr_node, mac_list); | |
84 | + rcu_read_unlock(); | |
85 | + if (node) { | |
86 | + list_del_rcu(&node->mac_list); | |
87 | + kfree(node); | |
88 | + } | |
89 | +} | |
90 | ||
91 | /* Allocate an hsr_node and add it to node_db. 'addr' is the node's AddressA; | |
92 | * seq_out is used to initialize filtering of outgoing duplicate frames | |
93 | --- a/net/hsr/hsr_framereg.h | |
94 | +++ b/net/hsr/hsr_framereg.h | |
95 | @@ -16,6 +16,7 @@ | |
96 | ||
97 | struct hsr_node; | |
98 | ||
99 | +void hsr_del_node(struct list_head *self_node_db); | |
100 | struct hsr_node *hsr_add_node(struct list_head *node_db, unsigned char addr[], | |
101 | u16 seq_out); | |
102 | struct hsr_node *hsr_get_node(struct hsr_port *port, struct sk_buff *skb, |