2023-08-03 21:05:38

by Fedor Pchelkin

Subject: [PATCH] drivers: vxlan: vnifilter: free percpu vni stats on error path

In case rhashtable_lookup_insert_fast() fails inside vxlan_vni_add(), the
allocated percpu vni stats are not freed on the error path.

Free them on the rhashtable_lookup_insert_fast() error path in
vxlan_vni_add().

Found by Linux Verification Center (linuxtesting.org).

Fixes: 4095e0e1328a ("drivers: vxlan: vnifilter: per vni stats")
Signed-off-by: Fedor Pchelkin <[email protected]>
---
drivers/net/vxlan/vxlan_vnifilter.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/drivers/net/vxlan/vxlan_vnifilter.c b/drivers/net/vxlan/vxlan_vnifilter.c
index a3de081cda5e..321cd0b450cc 100644
--- a/drivers/net/vxlan/vxlan_vnifilter.c
+++ b/drivers/net/vxlan/vxlan_vnifilter.c
@@ -740,6 +740,7 @@ static int vxlan_vni_add(struct vxlan_dev *vxlan,
&vninode->vnode,
vxlan_vni_rht_params);
if (err) {
+ free_percpu(vninode->stats);
kfree(vninode);
return err;
}
--
2.41.0

2023-08-04 16:49:29

by Ido Schimmel

Subject: Re: [PATCH] drivers: vxlan: vnifilter: free percpu vni stats on error path

Prefix should be "PATCH net". See:
https://www.kernel.org/doc/html/latest/process/maintainer-netdev.html

On Thu, Aug 03, 2023 at 10:38:32PM +0300, Fedor Pchelkin wrote:
> In case rhashtable_lookup_insert_fast() fails inside vxlan_vni_add(), the
> allocated percpu vni stats are not freed on the error path.
>
> Free them on the rhashtable_lookup_insert_fast() error path in
> vxlan_vni_add().
>
> Found by Linux Verification Center (linuxtesting.org).
>
> Fixes: 4095e0e1328a ("drivers: vxlan: vnifilter: per vni stats")
> Signed-off-by: Fedor Pchelkin <[email protected]>
> ---
> drivers/net/vxlan/vxlan_vnifilter.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/net/vxlan/vxlan_vnifilter.c b/drivers/net/vxlan/vxlan_vnifilter.c
> index a3de081cda5e..321cd0b450cc 100644
> --- a/drivers/net/vxlan/vxlan_vnifilter.c
> +++ b/drivers/net/vxlan/vxlan_vnifilter.c
> @@ -740,6 +740,7 @@ static int vxlan_vni_add(struct vxlan_dev *vxlan,
> &vninode->vnode,
> vxlan_vni_rht_params);
> if (err) {
> + free_percpu(vninode->stats);

This oversight (and future ones) wouldn't have happened if
vxlan_vni_alloc() had a corresponding vxlan_vni_free(). I suggest
something like [1].

BTW, I think the GFP_ATOMIC in vxlan_vni_alloc() should be GFP_KERNEL. I
will take care of it in net-next.

> kfree(vninode);
> return err;
> }
> --
> 2.41.0

[1]
diff --git a/drivers/net/vxlan/vxlan_vnifilter.c b/drivers/net/vxlan/vxlan_vnifilter.c
index a3de081cda5e..c3ff30ab782e 100644
--- a/drivers/net/vxlan/vxlan_vnifilter.c
+++ b/drivers/net/vxlan/vxlan_vnifilter.c
@@ -713,6 +713,12 @@ static struct vxlan_vni_node *vxlan_vni_alloc(struct vxlan_dev *vxlan,
return vninode;
}

+static void vxlan_vni_free(struct vxlan_vni_node *vninode)
+{
+ free_percpu(vninode->stats);
+ kfree(vninode);
+}
+
static int vxlan_vni_add(struct vxlan_dev *vxlan,
struct vxlan_vni_group *vg,
u32 vni, union vxlan_addr *group,
@@ -740,7 +746,7 @@ static int vxlan_vni_add(struct vxlan_dev *vxlan,
&vninode->vnode,
vxlan_vni_rht_params);
if (err) {
- kfree(vninode);
+ vxlan_vni_free(vninode);
return err;
}

@@ -763,8 +769,7 @@ static void vxlan_vni_node_rcu_free(struct rcu_head *rcu)
struct vxlan_vni_node *v;

v = container_of(rcu, struct vxlan_vni_node, rcu);
- free_percpu(v->stats);
- kfree(v);
+ vxlan_vni_free(v);
}

static int vxlan_vni_del(struct vxlan_dev *vxlan,