Received: by 2002:ac0:bc90:0:0:0:0:0 with SMTP id a16csp578697img; Fri, 22 Mar 2019 04:26:16 -0700 (PDT) X-Google-Smtp-Source: APXvYqyPnolYaKbBpuMHXNMic0wBWV7Hn6yNI7ED27H34hDUYF+wNa1oigoJUmgv3Ni9zuuWMH8U X-Received: by 2002:a65:6559:: with SMTP id a25mr7667478pgw.99.1553253976558; Fri, 22 Mar 2019 04:26:16 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1553253976; cv=none; d=google.com; s=arc-20160816; b=C/ki7Ak3HypgEgEQEUTAE5hQSTbnkkjKCk2s3RBgkZdmQMKKgTw1Ou/sb+yVgJ2/Ih POlvyIXTjWN4R57cemOoCQoHU35X1R1mJ45ZKhoyJbYsVso8GhWma6dIqNtOAI+7kwEE FGnbN8fMdEZkYHbTWrevHwWu8WGuv/3JJvEjW4oyddZ3ZDPGI3jonTwJFUUl1yREOMdi aaZv98yvOZ5ItAHwvSxjM2pFtABh/KLOkjDZyuNOt+e1uuQOL6Bxza2cjZpP33KAN3/J d7nmEjr+Ej3fvaoyOOD7HnJiSyRkJbMhNsCN4meGlgYdRsbIdbklYSAsEFmqlgeri6k+ DLCg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=iAdAtxrDs4SbLC1+mLdImteuQDp4PN+sCK8Kj59s57s=; b=Tso/dRN+yz7+X5VOfCHgDOij2ubeHATGWrAAiLKwcFt3REXcOOifp/Xh8gv6rmsnSB BLFRp5bgZTRl5CbuAjp15ybNGE+S66a1WVzXtH3ahrjM1ZrZRsvR00PnCu8tl4c5vCVz ntn7Trapokd9y33ADryL50gONvHAnq3GojnUWKAMruLa3DxXvqL34U1eBOPLefzFLNNN vGWqrOOXAxydpBc4jP9TM89Rk2aS1KoFwxhHCiDUhP7meIPbQwhZEjCBaX9kXSnIPfDE YrzxSLdcgjp8IGP85cG8+fz0yPWvi5bqWhTLb9V1fNgZH5kd5hz8mowam/3Udy4dXWVU FtKA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=z2C7+Xr3; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id 94si7044742plc.298.2019.03.22.04.25.59; Fri, 22 Mar 2019 04:26:16 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=z2C7+Xr3; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729121AbfCVLY0 (ORCPT + 99 others); Fri, 22 Mar 2019 07:24:26 -0400 Received: from mail.kernel.org ([198.145.29.99]:51474 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728560AbfCVLYZ (ORCPT ); Fri, 22 Mar 2019 07:24:25 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id C7D4D21925; Fri, 22 Mar 2019 11:24:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1553253864; bh=fIP43oyJlt0TwZE9n4WDRJIEUsWmqic1ls3n1RKQmWw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=z2C7+Xr3jZGR0AcbjfvIydywmHClpvDJ6oidyCYi+pBSkTlwsdojbh7WQYDqn3DC9 gFG1WAMT4VY9ZzH5rzkxYd1Yp/Agsi1DDzQV1wxBxpMQFPGJjOBSAoPzIV3W/u/+lD BeiwFDYqKll8fIxEhIF6h1yes0oD4pkaROzJ30e0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hulk Robot , Mao Wenan , "David S. Miller" Subject: [PATCH 3.18 080/134] net: hsr: fix memory leak in hsr_dev_finalize() Date: Fri, 22 Mar 2019 12:14:53 +0100 Message-Id: <20190322111215.897909965@linuxfoundation.org> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190322111210.465931067@linuxfoundation.org> References: <20190322111210.465931067@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Mao Wenan [ Upstream commit 6caabe7f197d3466d238f70915d65301f1716626 ] If hsr_add_port(hsr, hsr_dev, HSR_PT_MASTER) failed to add port, it directly returns res and forgets to free the node that allocated in hsr_create_self_node(), and forgets to delete the node->mac_list linked in hsr->self_node_db. BUG: memory leak unreferenced object 0xffff8881cfa0c780 (size 64): comm "syz-executor.0", pid 2077, jiffies 4294717969 (age 2415.377s) hex dump (first 32 bytes): e0 c7 a0 cf 81 88 ff ff 00 02 00 00 00 00 ad de ................ 00 e6 49 cd 81 88 ff ff c0 9b 87 d0 81 88 ff ff ..I............. backtrace: [<00000000e2ff5070>] hsr_dev_finalize+0x736/0x960 [hsr] [<000000003ed2e597>] hsr_newlink+0x2b2/0x3e0 [hsr] [<000000003fa8c6b6>] __rtnl_newlink+0xf1f/0x1600 net/core/rtnetlink.c:3182 [<000000001247a7ad>] rtnl_newlink+0x66/0x90 net/core/rtnetlink.c:3240 [<00000000e7d1b61d>] rtnetlink_rcv_msg+0x54e/0xb90 net/core/rtnetlink.c:5130 [<000000005556bd3a>] netlink_rcv_skb+0x129/0x340 net/netlink/af_netlink.c:2477 [<00000000741d5ee6>] netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline] [<00000000741d5ee6>] netlink_unicast+0x49a/0x650 net/netlink/af_netlink.c:1336 [<000000009d56f9b7>] netlink_sendmsg+0x88b/0xdf0 net/netlink/af_netlink.c:1917 [<0000000046b35c59>] sock_sendmsg_nosec net/socket.c:621 [inline] [<0000000046b35c59>] sock_sendmsg+0xc3/0x100 net/socket.c:631 [<00000000d208adc9>] __sys_sendto+0x33e/0x560 net/socket.c:1786 [<00000000b582837a>] __do_sys_sendto net/socket.c:1798 [inline] [<00000000b582837a>] __se_sys_sendto net/socket.c:1794 [inline] [<00000000b582837a>] __x64_sys_sendto+0xdd/0x1b0 net/socket.c:1794 [<00000000c866801d>] do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290 [<00000000fea382d9>] entry_SYSCALL_64_after_hwframe+0x49/0xbe [<00000000e01dacb3>] 0xffffffffffffffff Fixes: c5a759117210 ("net/hsr: Use list_head (and rcu) instead of array for slave devices.") Reported-by: Hulk Robot Signed-off-by: Mao Wenan Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/hsr/hsr_device.c | 4 +++- net/hsr/hsr_framereg.c | 12 ++++++++++++ net/hsr/hsr_framereg.h | 1 + 3 files changed, 16 insertions(+), 1 deletion(-) --- a/net/hsr/hsr_device.c +++ b/net/hsr/hsr_device.c @@ -474,7 +474,7 @@ int hsr_dev_finalize(struct net_device * res = hsr_add_port(hsr, hsr_dev, HSR_PT_MASTER); if (res) - return res; + goto err_add_port; res = register_netdevice(hsr_dev); if (res) @@ -495,6 +495,8 @@ int hsr_dev_finalize(struct net_device * fail: hsr_for_each_port(hsr, port) hsr_del_port(port); +err_add_port: + hsr_del_node(&hsr->self_node_db); return res; } --- a/net/hsr/hsr_framereg.c +++ b/net/hsr/hsr_framereg.c @@ -124,6 +124,18 @@ int hsr_create_self_node(struct list_hea return 0; } +void hsr_del_node(struct list_head *self_node_db) +{ + struct hsr_node *node; + + rcu_read_lock(); + node = list_first_or_null_rcu(self_node_db, struct hsr_node, mac_list); + rcu_read_unlock(); + if (node) { + list_del_rcu(&node->mac_list); + kfree(node); + } +} /* Allocate an hsr_node and add it to node_db. 'addr' is the node's AddressA; * seq_out is used to initialize filtering of outgoing duplicate frames --- a/net/hsr/hsr_framereg.h +++ b/net/hsr/hsr_framereg.h @@ -16,6 +16,7 @@ struct hsr_node; +void hsr_del_node(struct list_head *self_node_db); struct hsr_node *hsr_add_node(struct list_head *node_db, unsigned char addr[], u16 seq_out); struct hsr_node *hsr_get_node(struct list_head *node_db, struct sk_buff *skb,