Received: by 2002:a05:6a10:22f:0:0:0:0 with SMTP id 15csp360924pxk; Sun, 30 Aug 2020 06:20:53 -0700 (PDT) X-Google-Smtp-Source: ABdhPJyJ5ytlO+1MGsl1mqGcfkv3SQaXtX1GC6AqJPbf04TCAQddZJjTerc2Tt1U4UCTrCjy/rqY X-Received: by 2002:a17:906:fa0a:: with SMTP id lo10mr7577375ejb.172.1598793652963; Sun, 30 Aug 2020 06:20:52 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1598793652; cv=none; d=google.com; s=arc-20160816; b=xtLbwfMFIK/J3anPQbMjj7MDobluxcnC/YYWNVSaNdIbG7x/qeQmRnnqEeJ7PhgNBG xmkQ/xZEoOqnyjniaTWkV7fBzBoYCz/Z9mqoJVXMABjQ64n26SxN43Go9pbsmwU6bvAj vUsU0294SXcEJ10ioyK0hI5o5cwJMI7vHuWqaPXPoobPdeYbCfPrsjAb1tRJeq4e4uUU G113aQv1ISQ6/mszBCFHk6sZw/mo4EteczizNa0pwq9VFg2aFtCUIU7iYGR3ueQlbs4Y l/vcwcZBJzsMMbWLzs5hF9UJjUBKau0AcWVeIZ225RWv/kqZMDyFFy3a4qxtJpDbEoVA 6bVQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=+j3TxzpjcwHJjeRI7zoLPA9SPkk21BdzC8mVJDrt+pE=; b=l/U6fL+BjCDFbj0vA6Kd0m6ZiQ8BuGh1aNBEuiuh4qFdTnUVPh/Mb1LE+CtJSL7cah qyfuBbREVAmdgIwfaheI44xDX6rKOPcj6qsDHTum/rZPVKWck6XPzAJ9lNs1xcnmtxfg xRH4I4MJR/bRR8htsWEr/dyuUSn7dcfDXiWDKvwD6LLSQ/lLp1h0cISIj1mkIz4gdE3O jJ1+jfJTbM1vsGrsKxCKL1m/O9M935FOjY2ukfv6IKBQObqDv/eOa0/XbcPwY2IExrR+ gm7W5BHjARs7wMgQ2E8fMj5FuxdryK+kmjNvm+Gyh4JTKmA++CCl9uNnU2NnJQP/bmLe MOTA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gmail.com header.s=20161025 header.b=RO7NNB0j; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id l18si3069711ejr.492.2020.08.30.06.20.30; Sun, 30 Aug 2020 06:20:52 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@gmail.com header.s=20161025 header.b=RO7NNB0j; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728897AbgH3NPp (ORCPT + 99 others); Sun, 30 Aug 2020 09:15:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37358 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726030AbgH3NPU (ORCPT ); Sun, 30 Aug 2020 09:15:20 -0400 Received: from mail-pj1-x1041.google.com (mail-pj1-x1041.google.com [IPv6:2607:f8b0:4864:20::1041]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 07528C061573; Sun, 30 Aug 2020 06:15:19 -0700 (PDT) Received: by mail-pj1-x1041.google.com with SMTP id i13so1709662pjv.0; Sun, 30 Aug 2020 06:15:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=+j3TxzpjcwHJjeRI7zoLPA9SPkk21BdzC8mVJDrt+pE=; b=RO7NNB0jn1YTdQo4sFvc4RgowTC/uoxkT+efufWSBfiitS4HKZtox30Vjs2fgtDTgm 096r8JFxjZWOpbovb0/iYJ1T7/K/60oUf+JFYXhjswFFqeBMMaTRoXE/ndqoDnxvQjEO LiHbx3GIBk4G9b/Ma79T1vY9tA9JfG/WtOLUhkr0qeJfFVlB9ULoeg/BBMwk6BajL5tp qoqHyLIyoipO1Q86lt0Z2M04AkwdPa+vSWKQESN86gy+l0yPe6iOBM9E2VMJQqhowtHu +NoifOfvf4gSdgjCdFaXVz+bojKqTEsU7hbaM0fMKc+eufCTK1XZC8XuESzsvsOjyIld AjjQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=+j3TxzpjcwHJjeRI7zoLPA9SPkk21BdzC8mVJDrt+pE=; b=DD0j9YOsu95+tWN541HIxVrwlBhEJcgHDoI0n20HLZzUFECfEL9rVeMVgjqXs4zcUO o4EsNQF+T0mjrot/GKjPIg4KC20014LLfa38nKgAPv0yF+xFXeTW06cx2K6EgSIOeG9R RYqSnKB/ncC+LZtUbywjYMXOopPapHJqS87kUwAFzkgEHlZJgljqn5C2xZlneHKzvLlc tOwhZDLjTtnnSII/1x+kRjlszooIOFCtT/RCESmbJhUQYRqhcTaIn4TNBUzWqc7eEmqV utzXbBICRyo/gjxk8WyZFnQFtZWINcPPYa5M3iT2ldxB+PGPbAL5r4NQvqPVbnzkBOHP T3Sg== X-Gm-Message-State: AOAM530RVRU5UzKOBRxoQYmYIiOzE9mq1tPujxv3IzPTnnQXZLVZ3MFM iOCwPlLnRg6HkO5tjesWLrQ= X-Received: by 2002:a17:902:e901:: with SMTP id k1mr5364502pld.189.1598793318383; Sun, 30 Aug 2020 06:15:18 -0700 (PDT) Received: from localhost.localdomain (104.36.148.139.aurocloud.com. [104.36.148.139]) by smtp.gmail.com with ESMTPSA id i1sm4505185pgq.41.2020.08.30.06.15.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 30 Aug 2020 06:15:17 -0700 (PDT) From: Rustam Kovhaev To: davem@davemloft.net, kuba@kernel.org Cc: netdev@vger.kernel.org, bpf@vger.kernel.org, linux-kernel@vger.kernel.org, gregkh@linuxfoundation.org, Rustam Kovhaev Subject: [PATCH] veth: fix memory leak in veth_newlink() Date: Sun, 30 Aug 2020 06:13:36 -0700 Message-Id: <20200830131336.275844-1-rkovhaev@gmail.com> X-Mailer: git-send-email 2.28.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org when register_netdevice(dev) fails we should check whether struct veth_rq has been allocated via ndo_init callback and free it, because, depending on the code path, register_netdevice() might not call priv_destructor() callback Reported-and-tested-by: syzbot+59ef240dd8f0ed7598a8@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=59ef240dd8f0ed7598a8 Signed-off-by: Rustam Kovhaev --- drivers/net/veth.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/veth.c b/drivers/net/veth.c index a475f48d43c4..e40ca62a046a 100644 --- a/drivers/net/veth.c +++ b/drivers/net/veth.c @@ -1394,7 +1394,9 @@ static int veth_newlink(struct net *src_net, struct net_device *dev, return 0; err_register_dev: - /* nothing to do */ + priv = netdev_priv(dev); + if (priv->rq) + veth_dev_free(dev); err_configure_peer: unregister_netdevice(peer); return err; -- 2.28.0