From: Eric Dumazet <eric.dumazet@gmail.com>
To: Wang Hai <wanghai26@huawei.com>,
davem@davemloft.net, idosch@mellanox.com,
alexander.h.duyck@intel.com, tyhicks@canonical.com,
f.fainelli@gmail.com
Cc: amritha.nambiar@intel.com, joe@perches.com,
dmitry.torokhov@gmail.com, andriy.shevchenko@linux.intel.com,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] net-sysfs: Fix memory leak in netdev_register_kobject
Date: Mon, 18 Mar 2019 11:02:24 -0700 [thread overview]
Message-ID: <81c3db69-4589-97c7-960b-96812e6901d0@gmail.com> (raw)
In-Reply-To: <20190319050657.61327-1-wanghai26@huawei.com>
On 03/18/2019 10:06 PM, Wang Hai wrote:
> When registering struct net_device, it will call
> register_netdevice ->
> netdev_register_kobject ->
> device_add(dev)
> register_queue_kobjects(ndev)
>
> If device_add(dev) or register_queue_kobjects(ndev) fails.
> Register_netdevice() will return error, causing netdev_freemem(ndev)
> to be called to free net_device, however (&ndev->dev)->kobj.name will
> not be freed, resulting in a memory leak.
>
> syzkaller report this:
> BUG: memory leak
> unreferenced object 0xffff8881f4fad168 (size 8):
> comm "syz-executor.0", pid 3575, jiffies 4294778002 (age 20.134s)
> hex dump (first 8 bytes):
> 77 70 61 6e 30 00 ff ff wpan0...
> backtrace:
> [<000000006d2d91d7>] kstrdup_const+0x3d/0x50 mm/util.c:73
> [<00000000ba9ff953>] kvasprintf_const+0x112/0x170 lib/kasprintf.c:48
> [<000000005555ec09>] kobject_set_name_vargs+0x55/0x130 lib/kobject.c:281
> [<0000000098d28ec3>] dev_set_name+0xbb/0xf0 drivers/base/core.c:1915
> [<00000000b7553017>] netdev_register_kobject+0xc0/0x410 net/core/net-sysfs.c:1727
> [<00000000c826a797>] register_netdevice+0xa51/0xeb0 net/core/dev.c:8711
> [<00000000857bfcfd>] cfg802154_update_iface_num.isra.2+0x13/0x90 [ieee802154]
> [<000000003126e453>] ieee802154_llsec_fill_key_id+0x1d5/0x570 [ieee802154]
> [<00000000e4b3df51>] 0xffffffffc1500e0e
> [<00000000b4319776>] platform_drv_probe+0xc6/0x180 drivers/base/platform.c:614
> [<0000000037669347>] really_probe+0x491/0x7c0 drivers/base/dd.c:509
> [<000000008fed8862>] driver_probe_device+0xdc/0x240 drivers/base/dd.c:671
> [<00000000baf52041>] device_driver_attach+0xf2/0x130 drivers/base/dd.c:945
> [<00000000c7cc8dec>] __driver_attach+0x10e/0x210 drivers/base/dd.c:1022
> [<0000000057a757c2>] bus_for_each_dev+0x154/0x1e0 drivers/base/bus.c:304
> [<000000005f5ae04b>] bus_add_driver+0x427/0x5e0 drivers/base/bus.c:645
>
> Reported-by: Hulk Robot <hulkci@huawei.com>
> Fixes: 1d24eb4815d1 ("xps: Transmit Packet Steering")
The bug was there before this commit, right ?
next prev parent reply other threads:[~2019-03-18 18:02 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-03-19 5:06 [PATCH] net-sysfs: Fix memory leak in netdev_register_kobject Wang Hai
2019-03-18 15:57 ` Stephen Hemminger
2019-03-18 16:19 ` Andy Shevchenko
[not found] ` <c1c266af-7aaa-00a7-aa7a-e61c65665741@huawei.com>
2019-03-19 10:30 ` Andy Shevchenko
[not found] ` <18553079-7bbd-fcfe-ef1c-6717e963e0a5@huawei.com>
2019-03-19 14:00 ` Andy Shevchenko
2019-03-19 15:44 ` Stephen Hemminger
2019-03-19 3:03 ` wanghai (M)
2019-03-19 3:15 ` Stephen Hemminger
2019-03-19 3:39 ` wanghai (M)
2019-03-19 10:22 ` Andy Shevchenko
2019-03-18 18:02 ` Eric Dumazet [this message]
2019-03-19 3:47 ` wanghai (M)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=81c3db69-4589-97c7-960b-96812e6901d0@gmail.com \
--to=eric.dumazet@gmail.com \
--cc=alexander.h.duyck@intel.com \
--cc=amritha.nambiar@intel.com \
--cc=andriy.shevchenko@linux.intel.com \
--cc=davem@davemloft.net \
--cc=dmitry.torokhov@gmail.com \
--cc=f.fainelli@gmail.com \
--cc=idosch@mellanox.com \
--cc=joe@perches.com \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=tyhicks@canonical.com \
--cc=wanghai26@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.