releases/4.20.17/net-hsr-fix-memory-leak-in-hsr_dev_finalize.patch

   1 From foo@baz Thu Mar 14 23:20:15 PDT 2019
   2 From: Mao Wenan <maowenan@huawei.com>
   3 Date: Wed, 6 Mar 2019 22:45:01 +0800
   4 Subject: net: hsr: fix memory leak in hsr_dev_finalize()
   5
   6 From: Mao Wenan <maowenan@huawei.com>
   7
   8 [ Upstream commit 6caabe7f197d3466d238f70915d65301f1716626 ]
   9
  10 If hsr_add_port(hsr, hsr_dev, HSR_PT_MASTER) failed to
  11 add port, it directly returns res and forgets to free the node
  12 that allocated in hsr_create_self_node(), and forgets to delete
  13 the node->mac_list linked in hsr->self_node_db.
  14
  15 BUG: memory leak
  16 unreferenced object 0xffff8881cfa0c780 (size 64):
  17   comm "syz-executor.0", pid 2077, jiffies 4294717969 (age 2415.377s)
  18   hex dump (first 32 bytes):
  19     e0 c7 a0 cf 81 88 ff ff 00 02 00 00 00 00 ad de  ................
  20     00 e6 49 cd 81 88 ff ff c0 9b 87 d0 81 88 ff ff  ..I.............
  21   backtrace:
  22     [<00000000e2ff5070>] hsr_dev_finalize+0x736/0x960 [hsr]
  23     [<000000003ed2e597>] hsr_newlink+0x2b2/0x3e0 [hsr]
  24     [<000000003fa8c6b6>] __rtnl_newlink+0xf1f/0x1600 net/core/rtnetlink.c:3182
  25     [<000000001247a7ad>] rtnl_newlink+0x66/0x90 net/core/rtnetlink.c:3240
  26     [<00000000e7d1b61d>] rtnetlink_rcv_msg+0x54e/0xb90 net/core/rtnetlink.c:5130
  27     [<000000005556bd3a>] netlink_rcv_skb+0x129/0x340 net/netlink/af_netlink.c:2477
  28     [<00000000741d5ee6>] netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]
  29     [<00000000741d5ee6>] netlink_unicast+0x49a/0x650 net/netlink/af_netlink.c:1336
  30     [<000000009d56f9b7>] netlink_sendmsg+0x88b/0xdf0 net/netlink/af_netlink.c:1917
  31     [<0000000046b35c59>] sock_sendmsg_nosec net/socket.c:621 [inline]
  32     [<0000000046b35c59>] sock_sendmsg+0xc3/0x100 net/socket.c:631
  33     [<00000000d208adc9>] __sys_sendto+0x33e/0x560 net/socket.c:1786
  34     [<00000000b582837a>] __do_sys_sendto net/socket.c:1798 [inline]
  35     [<00000000b582837a>] __se_sys_sendto net/socket.c:1794 [inline]
  36     [<00000000b582837a>] __x64_sys_sendto+0xdd/0x1b0 net/socket.c:1794
  37     [<00000000c866801d>] do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
  38     [<00000000fea382d9>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
  39     [<00000000e01dacb3>] 0xffffffffffffffff
  40
  41 Fixes: c5a759117210 ("net/hsr: Use list_head (and rcu) instead of array for slave devices.")
  42 Reported-by: Hulk Robot <hulkci@huawei.com>
  43 Signed-off-by: Mao Wenan <maowenan@huawei.com>
  44 Signed-off-by: David S. Miller <davem@davemloft.net>
  45 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  46 ---
  47  net/hsr/hsr_device.c   |    4 +++-
  48  net/hsr/hsr_framereg.c |   12 ++++++++++++
  49  net/hsr/hsr_framereg.h |    1 +
  50  3 files changed, 16 insertions(+), 1 deletion(-)
  51
  52 --- a/net/hsr/hsr_device.c
  53 +++ b/net/hsr/hsr_device.c
  54 @@ -486,7 +486,7 @@ int hsr_dev_finalize(struct net_device *
  55
  56         res = hsr_add_port(hsr, hsr_dev, HSR_PT_MASTER);
  57         if (res)
  58 -               return res;
  59 +               goto err_add_port;
  60
  61         res = register_netdevice(hsr_dev);
  62         if (res)
  63 @@ -506,6 +506,8 @@ int hsr_dev_finalize(struct net_device *
  64  fail:
  65         hsr_for_each_port(hsr, port)
  66                 hsr_del_port(port);
  67 +err_add_port:
  68 +       hsr_del_node(&hsr->self_node_db);
  69
  70         return res;
  71  }
  72 --- a/net/hsr/hsr_framereg.c
  73 +++ b/net/hsr/hsr_framereg.c
  74 @@ -124,6 +124,18 @@ int hsr_create_self_node(struct list_hea
  75         return 0;
  76  }
  77
  78 +void hsr_del_node(struct list_head *self_node_db)
  79 +{
  80 +       struct hsr_node *node;
  81 +
  82 +       rcu_read_lock();
  83 +       node = list_first_or_null_rcu(self_node_db, struct hsr_node, mac_list);
  84 +       rcu_read_unlock();
  85 +       if (node) {
  86 +               list_del_rcu(&node->mac_list);
  87 +               kfree(node);
  88 +       }
  89 +}
  90
  91  /* Allocate an hsr_node and add it to node_db. 'addr' is the node's AddressA;
  92   * seq_out is used to initialize filtering of outgoing duplicate frames
  93 --- a/net/hsr/hsr_framereg.h
  94 +++ b/net/hsr/hsr_framereg.h
  95 @@ -16,6 +16,7 @@
  96
  97  struct hsr_node;
  98
  99 +void hsr_del_node(struct list_head *self_node_db);
 100  struct hsr_node *hsr_add_node(struct list_head *node_db, unsigned char addr[],
 101                               u16 seq_out);
 102  struct hsr_node *hsr_get_node(struct hsr_port *port, struct sk_buff *skb,