m->data needs to be freed when em_text_destroy is called.
Fixes: d675c989ed2d ("[PKT_SCHED]: Packet classification based on textsearch (ematch)")
Signed-off-by: Hangyu Hua <[email protected]>
---
net/sched/em_text.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/sched/em_text.c b/net/sched/em_text.c
index 6f3c1fb2fb44..b9d5d4dca2c9 100644
--- a/net/sched/em_text.c
+++ b/net/sched/em_text.c
@@ -97,8 +97,10 @@ static int em_text_change(struct net *net, void *data, int len,
static void em_text_destroy(struct tcf_ematch *m)
{
- if (EM_TEXT_PRIV(m) && EM_TEXT_PRIV(m)->config)
+ if (EM_TEXT_PRIV(m) && EM_TEXT_PRIV(m)->config) {
textsearch_destroy(EM_TEXT_PRIV(m)->config);
+ kfree(m->data);
+ }
}
static int em_text_dump(struct sk_buff *skb, struct tcf_ematch *m)
--
2.34.1
Hi Hangyu,
While the fix looks correct - can you please describe how you came
across this issue? Was it a tool or by inspection? Do you have a text
case that triggered something etc, etc.
On Tue, Dec 19, 2023 at 10:09 PM Hangyu Hua <[email protected]> wrote:
>
> m->data needs to be freed when em_text_destroy is called.
>
> Fixes: d675c989ed2d ("[PKT_SCHED]: Packet classification based on textsearch (ematch)")
> Signed-off-by: Hangyu Hua <[email protected]>
> ---
> net/sched/em_text.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/net/sched/em_text.c b/net/sched/em_text.c
> index 6f3c1fb2fb44..b9d5d4dca2c9 100644
> --- a/net/sched/em_text.c
> +++ b/net/sched/em_text.c
> @@ -97,8 +97,10 @@ static int em_text_change(struct net *net, void *data, int len,
>
> static void em_text_destroy(struct tcf_ematch *m)
> {
> - if (EM_TEXT_PRIV(m) && EM_TEXT_PRIV(m)->config)
> + if (EM_TEXT_PRIV(m) && EM_TEXT_PRIV(m)->config) {
> textsearch_destroy(EM_TEXT_PRIV(m)->config);
> + kfree(m->data);
> + }
> }
>
Acked-by: Jamal Hadi Salim <[email protected]>
cheers,
jamal
> static int em_text_dump(struct sk_buff *skb, struct tcf_ematch *m)
> --
> 2.34.1
>
Hi Hangyu,
kernel test robot noticed the following build warnings:
[auto build test WARNING on net-next/main]
[also build test WARNING on net/main linus/master v6.7-rc6]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Hangyu-Hua/net-sched-em_text-fix-possible-memory-leak-in-em_text_destroy/20231220-111317
base: net-next/main
patch link: https://lore.kernel.org/r/20231220030838.11751-1-hbh25y%40gmail.com
patch subject: [PATCH] net: sched: em_text: fix possible memory leak in em_text_destroy()
config: m68k-allmodconfig (https://download.01.org/0day-ci/archive/20231220/[email protected]/config)
compiler: m68k-linux-gcc (GCC) 13.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20231220/[email protected]/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <[email protected]>
| Closes: https://lore.kernel.org/oe-kbuild-all/[email protected]/
All warnings (new ones prefixed by >>):
net/sched/em_text.c: In function 'em_text_destroy':
>> net/sched/em_text.c:102:24: warning: passing argument 1 of 'kfree' makes pointer from integer without a cast [-Wint-conversion]
102 | kfree(m->data);
| ~^~~~~~
| |
| long unsigned int
In file included from net/sched/em_text.c:8:
include/linux/slab.h:227:24: note: expected 'const void *' but argument is of type 'long unsigned int'
227 | void kfree(const void *objp);
| ~~~~~~~~~~~~^~~~
vim +/kfree +102 net/sched/em_text.c
97
98 static void em_text_destroy(struct tcf_ematch *m)
99 {
100 if (EM_TEXT_PRIV(m) && EM_TEXT_PRIV(m)->config) {
101 textsearch_destroy(EM_TEXT_PRIV(m)->config);
> 102 kfree(m->data);
103 }
104 }
105
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
On Wed, Dec 20, 2023 at 6:55 AM Jamal Hadi Salim <[email protected]> wrote:
>
> Hi Hangyu,
> While the fix looks correct - can you please describe how you came
> across this issue? Was it a tool or by inspection? Do you have a text
> case that triggered something etc, etc.
>
> On Tue, Dec 19, 2023 at 10:09 PM Hangyu Hua <[email protected]> wrote:
> >
> > m->data needs to be freed when em_text_destroy is called.
> >
> > Fixes: d675c989ed2d ("[PKT_SCHED]: Packet classification based on textsearch (ematch)")
> > Signed-off-by: Hangyu Hua <[email protected]>
> > ---
> > net/sched/em_text.c | 4 +++-
> > 1 file changed, 3 insertions(+), 1 deletion(-)
> >
> > diff --git a/net/sched/em_text.c b/net/sched/em_text.c
> > index 6f3c1fb2fb44..b9d5d4dca2c9 100644
> > --- a/net/sched/em_text.c
> > +++ b/net/sched/em_text.c
> > @@ -97,8 +97,10 @@ static int em_text_change(struct net *net, void *data, int len,
> >
> > static void em_text_destroy(struct tcf_ematch *m)
> > {
> > - if (EM_TEXT_PRIV(m) && EM_TEXT_PRIV(m)->config)
> > + if (EM_TEXT_PRIV(m) && EM_TEXT_PRIV(m)->config) {
> > textsearch_destroy(EM_TEXT_PRIV(m)->config);
> > + kfree(m->data);
> > + }
> > }
> >
>
the bot just complained about needing a cast, use this:
struct text_match *
cheers,
jamal
> Acked-by: Jamal Hadi Salim <[email protected]>
>
> cheers,
> jamal
>
> > static int em_text_dump(struct sk_buff *skb, struct tcf_ematch *m)
> > --
> > 2.34.1
> >
Hi Hangyu,
kernel test robot noticed the following build errors:
[auto build test ERROR on net-next/main]
[also build test ERROR on net/main linus/master v6.7-rc6 next-20231220]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Hangyu-Hua/net-sched-em_text-fix-possible-memory-leak-in-em_text_destroy/20231220-111317
base: net-next/main
patch link: https://lore.kernel.org/r/20231220030838.11751-1-hbh25y%40gmail.com
patch subject: [PATCH] net: sched: em_text: fix possible memory leak in em_text_destroy()
config: x86_64-rhel-8.3-rust (https://download.01.org/0day-ci/archive/20231221/[email protected]/config)
compiler: clang version 16.0.4 (https://github.com/llvm/llvm-project.git ae42196bc493ffe877a7e3dff8be32035dea4d07)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20231221/[email protected]/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <[email protected]>
| Closes: https://lore.kernel.org/oe-kbuild-all/[email protected]/
All errors (new ones prefixed by >>):
>> net/sched/em_text.c:102:9: error: incompatible integer to pointer conversion passing 'unsigned long' to parameter of type 'const void *' [-Wint-conversion]
kfree(m->data);
^~~~~~~
include/linux/slab.h:227:24: note: passing argument to parameter 'objp' here
void kfree(const void *objp);
^
1 error generated.
vim +102 net/sched/em_text.c
97
98 static void em_text_destroy(struct tcf_ematch *m)
99 {
100 if (EM_TEXT_PRIV(m) && EM_TEXT_PRIV(m)->config) {
101 textsearch_destroy(EM_TEXT_PRIV(m)->config);
> 102 kfree(m->data);
103 }
104 }
105
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
On 21/12/2023 00:05, Jamal Hadi Salim wrote:
> On Wed, Dec 20, 2023 at 6:55 AM Jamal Hadi Salim <[email protected]> wrote:
>>
>> Hi Hangyu,
>> While the fix looks correct - can you please describe how you came
>> across this issue? Was it a tool or by inspection? Do you have a text
>> case that triggered something etc, etc.
I discovered this accidentally when I used gdb to debug a program that
uses em_text. And I think putting the code in the commit log will will
make it too bulky.
>>
>> On Tue, Dec 19, 2023 at 10:09 PM Hangyu Hua <[email protected]> wrote:
>>>
>>> m->data needs to be freed when em_text_destroy is called.
>>>
>>> Fixes: d675c989ed2d ("[PKT_SCHED]: Packet classification based on textsearch (ematch)")
>>> Signed-off-by: Hangyu Hua <[email protected]>
>>> ---
>>> net/sched/em_text.c | 4 +++-
>>> 1 file changed, 3 insertions(+), 1 deletion(-)
>>>
>>> diff --git a/net/sched/em_text.c b/net/sched/em_text.c
>>> index 6f3c1fb2fb44..b9d5d4dca2c9 100644
>>> --- a/net/sched/em_text.c
>>> +++ b/net/sched/em_text.c
>>> @@ -97,8 +97,10 @@ static int em_text_change(struct net *net, void *data, int len,
>>>
>>> static void em_text_destroy(struct tcf_ematch *m)
>>> {
>>> - if (EM_TEXT_PRIV(m) && EM_TEXT_PRIV(m)->config)
>>> + if (EM_TEXT_PRIV(m) && EM_TEXT_PRIV(m)->config) {
>>> textsearch_destroy(EM_TEXT_PRIV(m)->config);
>>> + kfree(m->data);
>>> + }
>>> }
>>>
>>
>
> the bot just complained about needing a cast, use this:
> struct text_match *
I see. I will send a v2 later.
Thanks,
Hangyu
>
> cheers,
> jamal
>> Acked-by: Jamal Hadi Salim <[email protected]>
>>
>> cheers,
>> jamal
>>
>>> static int em_text_dump(struct sk_buff *skb, struct tcf_ematch *m)
>>> --
>>> 2.34.1
>>>