releases/4.20.6/net-sched-act_tunnel_key-fix-memory-leak-in-case-of-action-replace.patch

   1 From foo@baz Sat Jan 26 10:22:50 CET 2019
   2 From: Davide Caratti <dcaratti@redhat.com>
   3 Date: Thu, 10 Jan 2019 20:21:02 +0100
   4 Subject: net/sched: act_tunnel_key: fix memory leak in case of action replace
   5
   6 From: Davide Caratti <dcaratti@redhat.com>
   7
   8 [ Upstream commit 9174c3df1cd181c14913138d50ccbe539bb08335 ]
   9
  10 running the following TDC test cases:
  11
  12  7afc - Replace tunnel_key set action with all parameters
  13  364d - Replace tunnel_key set action with all parameters and cookie
  14
  15 it's possible to trigger kmemleak warnings like:
  16
  17   unreferenced object 0xffff94797127ab40 (size 192):
  18   comm "tc", pid 3248, jiffies 4300565293 (age 1006.862s)
  19   hex dump (first 32 bytes):
  20     00 00 00 00 00 00 00 00 c0 93 f9 8a ff ff ff ff  ................
  21     41 84 ee 89 ff ff ff ff 00 00 00 00 00 00 00 00  A...............
  22   backtrace:
  23     [<000000001e85b61c>] tunnel_key_init+0x31d/0x820 [act_tunnel_key]
  24     [<000000007f3f6ee7>] tcf_action_init_1+0x384/0x4c0
  25     [<00000000e89e3ded>] tcf_action_init+0x12b/0x1a0
  26     [<00000000c1c8c0f8>] tcf_action_add+0x73/0x170
  27     [<0000000095a9fc28>] tc_ctl_action+0x122/0x160
  28     [<000000004bebeac5>] rtnetlink_rcv_msg+0x263/0x2d0
  29     [<000000009fd862dd>] netlink_rcv_skb+0x4a/0x110
  30     [<00000000b55199e7>] netlink_unicast+0x1a0/0x250
  31     [<000000004996cd21>] netlink_sendmsg+0x2c1/0x3c0
  32     [<000000004d6a94b4>] sock_sendmsg+0x36/0x40
  33     [<000000005d9f0208>] ___sys_sendmsg+0x280/0x2f0
  34     [<00000000dec19023>] __sys_sendmsg+0x5e/0xa0
  35     [<000000004b82ac81>] do_syscall_64+0x5b/0x180
  36     [<00000000a0f1209a>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
  37     [<000000002926b2ab>] 0xffffffffffffffff
  38
  39 when the tunnel_key action is replaced, the kernel forgets to release the
  40 dst metadata: ensure they are released by tunnel_key_init(), the same way
  41 it's done in tunnel_key_release().
  42
  43 Fixes: d0f6dd8a914f4 ("net/sched: Introduce act_tunnel_key")
  44 Signed-off-by: Davide Caratti <dcaratti@redhat.com>
  45 Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
  46 Signed-off-by: David S. Miller <davem@davemloft.net>
  47 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  48 ---
  49  net/sched/act_tunnel_key.c |   19 +++++++++++--------
  50  1 file changed, 11 insertions(+), 8 deletions(-)
  51
  52 --- a/net/sched/act_tunnel_key.c
  53 +++ b/net/sched/act_tunnel_key.c
  54 @@ -197,6 +197,15 @@ static const struct nla_policy tunnel_ke
  55         [TCA_TUNNEL_KEY_ENC_TTL]      = { .type = NLA_U8 },
  56  };
  57
  58 +static void tunnel_key_release_params(struct tcf_tunnel_key_params *p)
  59 +{
  60 +       if (!p)
  61 +               return;
  62 +       if (p->tcft_action == TCA_TUNNEL_KEY_ACT_SET)
  63 +               dst_release(&p->tcft_enc_metadata->dst);
  64 +       kfree_rcu(p, rcu);
  65 +}
  66 +
  67  static int tunnel_key_init(struct net *net, struct nlattr *nla,
  68                            struct nlattr *est, struct tc_action **a,
  69                            int ovr, int bind, bool rtnl_held,
  70 @@ -360,8 +369,7 @@ static int tunnel_key_init(struct net *n
  71         rcu_swap_protected(t->params, params_new,
  72                            lockdep_is_held(&t->tcf_lock));
  73         spin_unlock_bh(&t->tcf_lock);
  74 -       if (params_new)
  75 -               kfree_rcu(params_new, rcu);
  76 +       tunnel_key_release_params(params_new);
  77
  78         if (ret == ACT_P_CREATED)
  79                 tcf_idr_insert(tn, *a);
  80 @@ -385,12 +393,7 @@ static void tunnel_key_release(struct tc
  81         struct tcf_tunnel_key_params *params;
  82
  83         params = rcu_dereference_protected(t->params, 1);
  84 -       if (params) {
  85 -               if (params->tcft_action == TCA_TUNNEL_KEY_ACT_SET)
  86 -                       dst_release(&params->tcft_enc_metadata->dst);
  87 -
  88 -               kfree_rcu(params, rcu);
  89 -       }
  90 +       tunnel_key_release_params(params);
  91  }
  92
  93  static int tunnel_key_geneve_opts_dump(struct sk_buff *skb,