* [PATCH 1/1] bridge: mdb: fix leak on complete_info ptr on fail path
@ 2017-07-11 21:55 Eduardo Valentin
2017-07-12 3:02 ` David Miller
0 siblings, 1 reply; 3+ messages in thread
From: Eduardo Valentin @ 2017-07-11 21:55 UTC (permalink / raw)
To: Stephen Hemminger, David S . Miller
Cc: bridge, netdev, linux-kernel, Eduardo Valentin, stable # v4 . 9+
We currently get the following kmemleak report:
unreferenced object 0xffff8800039d9820 (size 32):
comm "softirq", pid 0, jiffies 4295212383 (age 792.416s)
hex dump (first 32 bytes):
00 0c e0 03 00 88 ff ff ff 02 00 00 00 00 00 00 ................
00 00 00 01 ff 11 00 02 86 dd 00 00 ff ff ff ff ................
backtrace:
[<ffffffff8152b4aa>] kmemleak_alloc+0x4a/0xa0
[<ffffffff811d8ec8>] kmem_cache_alloc_trace+0xb8/0x1c0
[<ffffffffa0389683>] __br_mdb_notify+0x2a3/0x300 [bridge]
[<ffffffffa038a0ce>] br_mdb_notify+0x6e/0x70 [bridge]
[<ffffffffa0386479>] br_multicast_add_group+0x109/0x150 [bridge]
[<ffffffffa0386518>] br_ip6_multicast_add_group+0x58/0x60 [bridge]
[<ffffffffa0387fb5>] br_multicast_rcv+0x1d5/0xdb0 [bridge]
[<ffffffffa037d7cf>] br_handle_frame_finish+0xcf/0x510 [bridge]
[<ffffffffa03a236b>] br_nf_hook_thresh.part.27+0xb/0x10 [br_netfilter]
[<ffffffffa03a3738>] br_nf_hook_thresh+0x48/0xb0 [br_netfilter]
[<ffffffffa03a3fb9>] br_nf_pre_routing_finish_ipv6+0x109/0x1d0 [br_netfilter]
[<ffffffffa03a4400>] br_nf_pre_routing_ipv6+0xd0/0x14c [br_netfilter]
[<ffffffffa03a3c27>] br_nf_pre_routing+0x197/0x3d0 [br_netfilter]
[<ffffffff814a2952>] nf_iterate+0x52/0x60
[<ffffffff814a29bc>] nf_hook_slow+0x5c/0xb0
[<ffffffffa037ddf4>] br_handle_frame+0x1a4/0x2c0 [bridge]
This happens when switchdev_port_obj_add() fails. This patch
frees complete_info object in the fail path.
Cc: stable <stable@vger.kernel.org> # v4.9+
Reviewed-by: Vallish Vaidyeshwara <vallish@amazon.com>
Signed-off-by: Eduardo Valentin <eduval@amazon.com>
---
net/bridge/br_mdb.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/bridge/br_mdb.c b/net/bridge/br_mdb.c
index b084548..c1030f8 100644
--- a/net/bridge/br_mdb.c
+++ b/net/bridge/br_mdb.c
@@ -323,7 +323,8 @@ static void __br_mdb_notify(struct net_device *dev, struct net_bridge_port *p,
__mdb_entry_to_br_ip(entry, &complete_info->ip);
mdb.obj.complete_priv = complete_info;
mdb.obj.complete = br_mdb_complete;
- switchdev_port_obj_add(port_dev, &mdb.obj);
+ if (switchdev_port_obj_add(port_dev, &mdb.obj))
+ kfree(complete_info);
}
} else if (port_dev && type == RTM_DELMDB) {
switchdev_port_obj_del(port_dev, &mdb.obj);
--
2.7.4
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH 1/1] bridge: mdb: fix leak on complete_info ptr on fail path
2017-07-11 21:55 [PATCH 1/1] bridge: mdb: fix leak on complete_info ptr on fail path Eduardo Valentin
@ 2017-07-12 3:02 ` David Miller
2017-07-12 21:02 ` Eduardo Valentin
0 siblings, 1 reply; 3+ messages in thread
From: David Miller @ 2017-07-12 3:02 UTC (permalink / raw)
To: eduval; +Cc: stephen, bridge, netdev, linux-kernel, stable
From: Eduardo Valentin <eduval@amazon.com>
Date: Tue, 11 Jul 2017 14:55:12 -0700
> We currently get the following kmemleak report:
> unreferenced object 0xffff8800039d9820 (size 32):
> comm "softirq", pid 0, jiffies 4295212383 (age 792.416s)
> hex dump (first 32 bytes):
> 00 0c e0 03 00 88 ff ff ff 02 00 00 00 00 00 00 ................
> 00 00 00 01 ff 11 00 02 86 dd 00 00 ff ff ff ff ................
> backtrace:
> [<ffffffff8152b4aa>] kmemleak_alloc+0x4a/0xa0
> [<ffffffff811d8ec8>] kmem_cache_alloc_trace+0xb8/0x1c0
> [<ffffffffa0389683>] __br_mdb_notify+0x2a3/0x300 [bridge]
> [<ffffffffa038a0ce>] br_mdb_notify+0x6e/0x70 [bridge]
> [<ffffffffa0386479>] br_multicast_add_group+0x109/0x150 [bridge]
> [<ffffffffa0386518>] br_ip6_multicast_add_group+0x58/0x60 [bridge]
> [<ffffffffa0387fb5>] br_multicast_rcv+0x1d5/0xdb0 [bridge]
> [<ffffffffa037d7cf>] br_handle_frame_finish+0xcf/0x510 [bridge]
> [<ffffffffa03a236b>] br_nf_hook_thresh.part.27+0xb/0x10 [br_netfilter]
> [<ffffffffa03a3738>] br_nf_hook_thresh+0x48/0xb0 [br_netfilter]
> [<ffffffffa03a3fb9>] br_nf_pre_routing_finish_ipv6+0x109/0x1d0 [br_netfilter]
> [<ffffffffa03a4400>] br_nf_pre_routing_ipv6+0xd0/0x14c [br_netfilter]
> [<ffffffffa03a3c27>] br_nf_pre_routing+0x197/0x3d0 [br_netfilter]
> [<ffffffff814a2952>] nf_iterate+0x52/0x60
> [<ffffffff814a29bc>] nf_hook_slow+0x5c/0xb0
> [<ffffffffa037ddf4>] br_handle_frame+0x1a4/0x2c0 [bridge]
>
> This happens when switchdev_port_obj_add() fails. This patch
> frees complete_info object in the fail path.
Applied, thanks.
I'm so glad I pushed back on your original patch :-)
> Cc: stable <stable@vger.kernel.org> # v4.9+
Please do not add stable tags to networking patches, I queue up and
submit networking -stable changes myself upon request which I am doing
in this case as well.
Thanks.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH 1/1] bridge: mdb: fix leak on complete_info ptr on fail path
2017-07-12 3:02 ` David Miller
@ 2017-07-12 21:02 ` Eduardo Valentin
0 siblings, 0 replies; 3+ messages in thread
From: Eduardo Valentin @ 2017-07-12 21:02 UTC (permalink / raw)
To: David Miller; +Cc: eduval, stephen, bridge, netdev, linux-kernel, stable
On Tue, Jul 11, 2017 at 08:02:33PM -0700, David Miller wrote:
> From: Eduardo Valentin <eduval@amazon.com>
> Date: Tue, 11 Jul 2017 14:55:12 -0700
>
> > We currently get the following kmemleak report:
> > unreferenced object 0xffff8800039d9820 (size 32):
> > comm "softirq", pid 0, jiffies 4295212383 (age 792.416s)
> > hex dump (first 32 bytes):
> > 00 0c e0 03 00 88 ff ff ff 02 00 00 00 00 00 00 ................
> > 00 00 00 01 ff 11 00 02 86 dd 00 00 ff ff ff ff ................
> > backtrace:
> > [<ffffffff8152b4aa>] kmemleak_alloc+0x4a/0xa0
> > [<ffffffff811d8ec8>] kmem_cache_alloc_trace+0xb8/0x1c0
> > [<ffffffffa0389683>] __br_mdb_notify+0x2a3/0x300 [bridge]
> > [<ffffffffa038a0ce>] br_mdb_notify+0x6e/0x70 [bridge]
> > [<ffffffffa0386479>] br_multicast_add_group+0x109/0x150 [bridge]
> > [<ffffffffa0386518>] br_ip6_multicast_add_group+0x58/0x60 [bridge]
> > [<ffffffffa0387fb5>] br_multicast_rcv+0x1d5/0xdb0 [bridge]
> > [<ffffffffa037d7cf>] br_handle_frame_finish+0xcf/0x510 [bridge]
> > [<ffffffffa03a236b>] br_nf_hook_thresh.part.27+0xb/0x10 [br_netfilter]
> > [<ffffffffa03a3738>] br_nf_hook_thresh+0x48/0xb0 [br_netfilter]
> > [<ffffffffa03a3fb9>] br_nf_pre_routing_finish_ipv6+0x109/0x1d0 [br_netfilter]
> > [<ffffffffa03a4400>] br_nf_pre_routing_ipv6+0xd0/0x14c [br_netfilter]
> > [<ffffffffa03a3c27>] br_nf_pre_routing+0x197/0x3d0 [br_netfilter]
> > [<ffffffff814a2952>] nf_iterate+0x52/0x60
> > [<ffffffff814a29bc>] nf_hook_slow+0x5c/0xb0
> > [<ffffffffa037ddf4>] br_handle_frame+0x1a4/0x2c0 [bridge]
> >
> > This happens when switchdev_port_obj_add() fails. This patch
> > frees complete_info object in the fail path.
>
> Applied, thanks.
>
Thanks!
> I'm so glad I pushed back on your original patch :-)
man, me too !! :-)
>
> > Cc: stable <stable@vger.kernel.org> # v4.9+
>
> Please do not add stable tags to networking patches, I queue up and
> submit networking -stable changes myself upon request which I am doing
> in this case as well.
Oh, I see. I won't copy stable next time and I will request you to queue, when applicable.
>
> Thanks.
--
All the best,
Eduardo Valentin
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-07-12 21:05 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-07-11 21:55 [PATCH 1/1] bridge: mdb: fix leak on complete_info ptr on fail path Eduardo Valentin
2017-07-12 3:02 ` David Miller
2017-07-12 21:02 ` Eduardo Valentin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).