* [PATCH net] tipc: purge deferredq list for each grp member in tipc_group_delete
@ 2019-06-16 9:24 Xin Long
2019-06-17 2:42 ` Ying Xue
2019-06-17 3:42 ` David Miller
0 siblings, 2 replies; 3+ messages in thread
From: Xin Long @ 2019-06-16 9:24 UTC (permalink / raw)
To: network dev; +Cc: davem, Jon Maloy, Ying Xue, tipc-discussion, syzkaller-bugs
Syzbot reported a memleak caused by grp members' deferredq list not
purged when the grp is be deleted.
The issue occurs when more(msg_grp_bc_seqno(hdr), m->bc_rcv_nxt) in
tipc_group_filter_msg() and the skb will stay in deferredq.
So fix it by calling __skb_queue_purge for each member's deferredq
in tipc_group_delete() when a tipc sk leaves the grp.
Fixes: b87a5ea31c93 ("tipc: guarantee group unicast doesn't bypass group broadcast")
Reported-by: syzbot+78fbe679c8ca8d264a8d@syzkaller.appspotmail.com
Signed-off-by: Xin Long <lucien.xin@gmail.com>
---
net/tipc/group.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/tipc/group.c b/net/tipc/group.c
index 992be61..5f98d38 100644
--- a/net/tipc/group.c
+++ b/net/tipc/group.c
@@ -218,6 +218,7 @@ void tipc_group_delete(struct net *net, struct tipc_group *grp)
rbtree_postorder_for_each_entry_safe(m, tmp, tree, tree_node) {
tipc_group_proto_xmit(grp, m, GRP_LEAVE_MSG, &xmitq);
+ __skb_queue_purge(&m->deferredq);
list_del(&m->list);
kfree(m);
}
--
2.1.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH net] tipc: purge deferredq list for each grp member in tipc_group_delete
2019-06-16 9:24 [PATCH net] tipc: purge deferredq list for each grp member in tipc_group_delete Xin Long
@ 2019-06-17 2:42 ` Ying Xue
2019-06-17 3:42 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: Ying Xue @ 2019-06-17 2:42 UTC (permalink / raw)
To: Xin Long, network dev; +Cc: davem, Jon Maloy, tipc-discussion, syzkaller-bugs
On 6/16/19 5:24 PM, Xin Long wrote:
> Syzbot reported a memleak caused by grp members' deferredq list not
> purged when the grp is be deleted.
>
> The issue occurs when more(msg_grp_bc_seqno(hdr), m->bc_rcv_nxt) in
> tipc_group_filter_msg() and the skb will stay in deferredq.
>
> So fix it by calling __skb_queue_purge for each member's deferredq
> in tipc_group_delete() when a tipc sk leaves the grp.
>
> Fixes: b87a5ea31c93 ("tipc: guarantee group unicast doesn't bypass group broadcast")
> Reported-by: syzbot+78fbe679c8ca8d264a8d@syzkaller.appspotmail.com
> Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Ying Xue <ying.xue@windriver.com>
> ---
> net/tipc/group.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/net/tipc/group.c b/net/tipc/group.c
> index 992be61..5f98d38 100644
> --- a/net/tipc/group.c
> +++ b/net/tipc/group.c
> @@ -218,6 +218,7 @@ void tipc_group_delete(struct net *net, struct tipc_group *grp)
>
> rbtree_postorder_for_each_entry_safe(m, tmp, tree, tree_node) {
> tipc_group_proto_xmit(grp, m, GRP_LEAVE_MSG, &xmitq);
> + __skb_queue_purge(&m->deferredq);
> list_del(&m->list);
> kfree(m);
> }
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH net] tipc: purge deferredq list for each grp member in tipc_group_delete
2019-06-16 9:24 [PATCH net] tipc: purge deferredq list for each grp member in tipc_group_delete Xin Long
2019-06-17 2:42 ` Ying Xue
@ 2019-06-17 3:42 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: David Miller @ 2019-06-17 3:42 UTC (permalink / raw)
To: lucien.xin; +Cc: netdev, jon.maloy, ying.xue, tipc-discussion, syzkaller-bugs
From: Xin Long <lucien.xin@gmail.com>
Date: Sun, 16 Jun 2019 17:24:07 +0800
> Syzbot reported a memleak caused by grp members' deferredq list not
> purged when the grp is be deleted.
>
> The issue occurs when more(msg_grp_bc_seqno(hdr), m->bc_rcv_nxt) in
> tipc_group_filter_msg() and the skb will stay in deferredq.
>
> So fix it by calling __skb_queue_purge for each member's deferredq
> in tipc_group_delete() when a tipc sk leaves the grp.
>
> Fixes: b87a5ea31c93 ("tipc: guarantee group unicast doesn't bypass group broadcast")
> Reported-by: syzbot+78fbe679c8ca8d264a8d@syzkaller.appspotmail.com
> Signed-off-by: Xin Long <lucien.xin@gmail.com>
Applied, thanks.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-06-17 3:42 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-06-16 9:24 [PATCH net] tipc: purge deferredq list for each grp member in tipc_group_delete Xin Long
2019-06-17 2:42 ` Ying Xue
2019-06-17 3:42 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.