From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AH8x227iel8jGXGdypYnmEgDYPixUK0ED/0fienckjUuRCxzcH4Va89nnKvWHJad9cPMm9ZK5AVG ARC-Seal: i=1; a=rsa-sha256; t=1517256381; cv=none; d=google.com; s=arc-20160816; b=gXI9FeZAdSLjszz7pDMjzVbNbNFy5Sh5kexF4+931vvSt/k7LYU/eG99v2rbLNTTf0 s+xiil9MLcqoboTgKknraQ5XW32kn2pGBSRzZoEl6Vin1klLT3mQp++6BOQ9Lz0avio1 dEbZPObFK7CfbgIzDfncDVS58Gh9rp3fauVoxtznoKUWoILwKoEoLs/GmaEmnaFqYNv0 mW7Zeo1VVgKBTJCETUtc5wO+9tQuYSwygIaW3HR9yd8FiG56qjIlxlY0w4mYY89qCeQU iuAap5w4PLyY2ET2QvS8lnepaopEAAgBTyyu0qtYuiofrAM5rP+zGWGvo3XcQsMhOSNu TJtg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:user-agent:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=gkvrh+u89h9ILLYGBt6JNz42DjiqFvTF7kiulKPcUrY=; b=yy3FY/zX3nrggdMbP8s7UacNQeR9bGrsHEbTaaM0IPAYPogqk206LwWCyC+AQsW5AT H3k9tAFY9ipkI/fPBJOT+uZ+mFv5Ohy7yFYxIEc5aQip2aihzddBLklYUtnfwucD5osj GmOUh8uUcomx0lUuRFbHD9eEbX3J2kfq8vuQ2C7GPQmRv1smOm1qnS+S8egEpMLEb8wm R34bs5BBr0O/EBf8rls+enHFnx4lonnh47QizXgCy2RSSek5MkxHSbdq0xY1HE3YraFx EIdhMmRQWfNmDvPpxUJtw0le331uvzHAL9LdOHpoEsFgzy6kMNpChMPg5g3LNk3P5HxF Me+g== ARC-Authentication-Results: i=1; mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dmitry Vyukov , Jason Wang , Cong Wang , "David S. Miller" Subject: [PATCH 4.9 54/66] tun: fix a memory leak for tfile->tx_array Date: Mon, 29 Jan 2018 13:57:18 +0100 Message-Id: <20180129123842.751700262@linuxfoundation.org> X-Mailer: git-send-email 2.16.1 In-Reply-To: <20180129123839.842860149@linuxfoundation.org> References: <20180129123839.842860149@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-LABELS: =?utf-8?b?IlxcU2VudCI=?= X-GMAIL-THRID: =?utf-8?q?1590958628395807783?= X-GMAIL-MSGID: =?utf-8?q?1590958628395807783?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: 4.9-stable review patch. If anyone has any objections, please let me know. ------------------ From: Cong Wang [ Upstream commit 4df0bfc79904b7169dc77dcce44598b1545721f9 ] tfile->tun could be detached before we close the tun fd, via tun_detach_all(), so it should not be used to check for tfile->tx_array. As Jason suggested, we probably have to clean it up unconditionally both in __tun_deatch() and tun_detach_all(), but this requires to check if it is initialized or not. Currently skb_array_cleanup() doesn't have such a check, so I check it in the caller and introduce a helper function, it is a bit ugly but we can always improve it in net-next. Reported-by: Dmitry Vyukov Fixes: 1576d9860599 ("tun: switch to use skb array for tx") Cc: Jason Wang Signed-off-by: Cong Wang Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- drivers/net/tun.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -525,6 +525,14 @@ static void tun_queue_purge(struct tun_f skb_queue_purge(&tfile->sk.sk_error_queue); } +static void tun_cleanup_tx_array(struct tun_file *tfile) +{ + if (tfile->tx_array.ring.queue) { + skb_array_cleanup(&tfile->tx_array); + memset(&tfile->tx_array, 0, sizeof(tfile->tx_array)); + } +} + static void __tun_detach(struct tun_file *tfile, bool clean) { struct tun_file *ntfile; @@ -566,8 +574,7 @@ static void __tun_detach(struct tun_file tun->dev->reg_state == NETREG_REGISTERED) unregister_netdevice(tun->dev); } - if (tun) - skb_array_cleanup(&tfile->tx_array); + tun_cleanup_tx_array(tfile); sock_put(&tfile->sk); } } @@ -606,11 +613,13 @@ static void tun_detach_all(struct net_de /* Drop read queue */ tun_queue_purge(tfile); sock_put(&tfile->sk); + tun_cleanup_tx_array(tfile); } list_for_each_entry_safe(tfile, tmp, &tun->disabled, next) { tun_enable_queue(tfile); tun_queue_purge(tfile); sock_put(&tfile->sk); + tun_cleanup_tx_array(tfile); } BUG_ON(tun->numdisabled != 0); @@ -2363,6 +2372,8 @@ static int tun_chr_open(struct inode *in sock_set_flag(&tfile->sk, SOCK_ZEROCOPY); + memset(&tfile->tx_array, 0, sizeof(tfile->tx_array)); + return 0; }