From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Yang Yingliang <yangyingliang@huawei.com>,
Hulk Robot <hulkci@huawei.com>,
"David S . Miller" <davem@davemloft.net>,
Sasha Levin <sashal@kernel.org>,
netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 5.10 02/17] net/802/garp: fix memleak in garp_request_join()
Date: Thu, 22 Jul 2021 23:57:33 -0400 [thread overview]
Message-ID: <20210723035748.531594-2-sashal@kernel.org> (raw)
In-Reply-To: <20210723035748.531594-1-sashal@kernel.org>
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit 42ca63f980842918560b25f0244307fd83b4777c ]
I got kmemleak report when doing fuzz test:
BUG: memory leak
unreferenced object 0xffff88810c909b80 (size 64):
comm "syz", pid 957, jiffies 4295220394 (age 399.090s)
hex dump (first 32 bytes):
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 08 00 00 00 01 02 00 04 ................
backtrace:
[<00000000ca1f2e2e>] garp_request_join+0x285/0x3d0
[<00000000bf153351>] vlan_gvrp_request_join+0x15b/0x190
[<0000000024005e72>] vlan_dev_open+0x706/0x980
[<00000000dc20c4d4>] __dev_open+0x2bb/0x460
[<0000000066573004>] __dev_change_flags+0x501/0x650
[<0000000035b42f83>] rtnl_configure_link+0xee/0x280
[<00000000a5e69de0>] __rtnl_newlink+0xed5/0x1550
[<00000000a5258f4a>] rtnl_newlink+0x66/0x90
[<00000000506568ee>] rtnetlink_rcv_msg+0x439/0xbd0
[<00000000b7eaeae1>] netlink_rcv_skb+0x14d/0x420
[<00000000c373ce66>] netlink_unicast+0x550/0x750
[<00000000ec74ce74>] netlink_sendmsg+0x88b/0xda0
[<00000000381ff246>] sock_sendmsg+0xc9/0x120
[<000000008f6a2db3>] ____sys_sendmsg+0x6e8/0x820
[<000000008d9c1735>] ___sys_sendmsg+0x145/0x1c0
[<00000000aa39dd8b>] __sys_sendmsg+0xfe/0x1d0
Calling garp_request_leave() after garp_request_join(), the attr->state
is set to GARP_APPLICANT_VO, garp_attr_destroy() won't be called in last
transmit event in garp_uninit_applicant(), the attr of applicant will be
leaked. To fix this leak, iterate and free each attr of applicant before
rerturning from garp_uninit_applicant().
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/802/garp.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/net/802/garp.c b/net/802/garp.c
index 400bd857e5f5..f6012f8e59f0 100644
--- a/net/802/garp.c
+++ b/net/802/garp.c
@@ -203,6 +203,19 @@ static void garp_attr_destroy(struct garp_applicant *app, struct garp_attr *attr
kfree(attr);
}
+static void garp_attr_destroy_all(struct garp_applicant *app)
+{
+ struct rb_node *node, *next;
+ struct garp_attr *attr;
+
+ for (node = rb_first(&app->gid);
+ next = node ? rb_next(node) : NULL, node != NULL;
+ node = next) {
+ attr = rb_entry(node, struct garp_attr, node);
+ garp_attr_destroy(app, attr);
+ }
+}
+
static int garp_pdu_init(struct garp_applicant *app)
{
struct sk_buff *skb;
@@ -609,6 +622,7 @@ void garp_uninit_applicant(struct net_device *dev, struct garp_application *appl
spin_lock_bh(&app->lock);
garp_gid_event(app, GARP_EVENT_TRANSMIT_PDU);
+ garp_attr_destroy_all(app);
garp_pdu_queue(app);
spin_unlock_bh(&app->lock);
--
2.30.2
next prev parent reply other threads:[~2021-07-23 3:58 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-07-23 3:57 [PATCH AUTOSEL 5.10 01/17] net/802/mrp: fix memleak in mrp_request_join() Sasha Levin
2021-07-23 3:57 ` Sasha Levin [this message]
2021-07-23 3:57 ` [PATCH AUTOSEL 5.10 03/17] net: annotate data race around sk_ll_usec Sasha Levin
2021-07-23 3:57 ` [PATCH AUTOSEL 5.10 04/17] sctp: move 198 addresses from unusable to private scope Sasha Levin
2021-07-23 3:57 ` [PATCH AUTOSEL 5.10 05/17] rcu-tasks: Don't delete holdouts within trc_inspect_reader() Sasha Levin
2021-07-23 3:57 ` [PATCH AUTOSEL 5.10 06/17] rcu-tasks: Don't delete holdouts within trc_wait_for_one_reader() Sasha Levin
2021-07-23 3:57 ` [PATCH AUTOSEL 5.10 07/17] ipv6: allocate enough headroom in ip6_finish_output2() Sasha Levin
2021-07-23 3:57 ` [PATCH AUTOSEL 5.10 08/17] drm/ttm: add a check against null pointer dereference Sasha Levin
2021-07-23 3:57 ` [PATCH AUTOSEL 5.10 09/17] hfs: add missing clean-up in hfs_fill_super Sasha Levin
2021-07-23 3:57 ` [PATCH AUTOSEL 5.10 10/17] hfs: fix high memory mapping in hfs_bnode_read Sasha Levin
2021-07-23 3:57 ` [PATCH AUTOSEL 5.10 11/17] hfs: add lock nesting notation to hfs_find_init Sasha Levin
2021-07-23 3:57 ` [PATCH AUTOSEL 5.10 12/17] firmware: arm_scmi: Fix possible scmi_linux_errmap buffer overflow Sasha Levin
2021-07-23 3:57 ` [PATCH AUTOSEL 5.10 13/17] firmware: arm_scmi: Fix range check for the maximum number of pending messages Sasha Levin
2021-07-23 3:57 ` [PATCH AUTOSEL 5.10 14/17] cifs: fix the out of range assignment to bit fields in parse_server_interfaces Sasha Levin
2021-07-23 3:57 ` [PATCH AUTOSEL 5.10 15/17] iomap: remove the length variable in iomap_seek_data Sasha Levin
2021-07-23 3:57 ` [PATCH AUTOSEL 5.10 16/17] iomap: remove the length variable in iomap_seek_hole Sasha Levin
2021-07-23 3:57 ` [PATCH AUTOSEL 5.10 17/17] ARM: dts: versatile: Fix up interrupt controller node names Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210723035748.531594-2-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=davem@davemloft.net \
--cc=hulkci@huawei.com \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=yangyingliang@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).