From: Cong Wang <xiyou.wangcong@gmail.com>
To: linmiaohe <linmiaohe@huawei.com>
Cc: David Miller <davem@davemloft.net>,
"kuba@kernel.org" <kuba@kernel.org>,
"edumazet@google.com" <edumazet@google.com>,
"kafai@fb.com" <kafai@fb.com>,
"daniel@iogearbox.net" <daniel@iogearbox.net>,
"jakub@cloudflare.com" <jakub@cloudflare.com>,
"keescook@chromium.org" <keescook@chromium.org>,
"zhang.lin16@zte.com.cn" <zhang.lin16@zte.com.cn>,
"netdev@vger.kernel.org" <netdev@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH] net: Fix potential memory leak in proto_register()
Date: Wed, 12 Aug 2020 10:57:19 -0700 [thread overview]
Message-ID: <CAM_iQpXhXK3SfRmy+qLTVhQ3s0-=n6TjC8RmG3XYLr-BAenQPA@mail.gmail.com> (raw)
In-Reply-To: <a139c6e194974321822b4ef3d469aefe@huawei.com>
On Wed, Aug 12, 2020 at 2:21 AM linmiaohe <linmiaohe@huawei.com> wrote:
>
> Hi all:
> David Miller <davem@davemloft.net> wrote:
> >From: Cong Wang <xiyou.wangcong@gmail.com>
> >Date: Tue, 11 Aug 2020 16:02:51 -0700
> >
> >>> @@ -3406,6 +3406,16 @@ static void sock_inuse_add(struct net *net,
> >>> int val) } #endif
> >>>
> >>> +static void tw_prot_cleanup(struct timewait_sock_ops *twsk_prot) {
> >>> + if (!twsk_prot)
> >>> + return;
> >>> + kfree(twsk_prot->twsk_slab_name);
> >>> + twsk_prot->twsk_slab_name = NULL;
> >>> + kmem_cache_destroy(twsk_prot->twsk_slab);
> >>
> >> Hmm, are you sure you can free the kmem cache name before
> >> kmem_cache_destroy()? To me, it seems kmem_cache_destroy() frees the
> >> name via slab_kmem_cache_release() via kfree_const().
> >> With your patch, we have a double-free on the name?
> >>
> >> Or am I missing anything?
> >
> >Yep, there is a double free here.
> >
> >Please fix this.
>
> Many thanks for both of you to point this issue out. But I'am not really understand, could you please explain it more?
> As far as I can see, the double free path is:
> 1. kfree(twsk_prot->twsk_slab_name)
> 2. kmem_cache_destroy
> --> shutdown_memcg_caches
> --> shutdown_cache
> --> slab_kmem_cache_release
> --> kfree_const(s->name)
> But twsk_prot->twsk_slab_name is allocated from kasprintf via kmalloc_track_caller while twsk_prot->twsk_slab->name is allocated
> via kstrdup_const. So I think twsk_prot->twsk_slab_name and twsk_prot->twsk_slab->name point to different memory, and there is no double free.
>
You are right. Since it is duplicated, then there is no need to keep
->twsk_slab_name, we can just use twsk_slab->name. I will send
a patch to get rid of it.
> Or am I missing anything?
>
> By the way, req_prot_cleanup() do the same things, i.e. free the slab_name before involve kmem_cache_destroy(). If there is a double
> free, so as here?
Ditto. Can be just removed.
Thanks.
next prev parent reply other threads:[~2020-08-12 17:57 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-08-12 9:21 [PATCH] net: Fix potential memory leak in proto_register() linmiaohe
2020-08-12 17:57 ` Cong Wang [this message]
-- strict thread matches above, loose matches on Subject: below --
2020-08-10 12:16 Miaohe Lin
2020-08-11 22:37 ` David Miller
2020-08-11 23:02 ` Cong Wang
2020-08-11 23:10 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAM_iQpXhXK3SfRmy+qLTVhQ3s0-=n6TjC8RmG3XYLr-BAenQPA@mail.gmail.com' \
--to=xiyou.wangcong@gmail.com \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=jakub@cloudflare.com \
--cc=kafai@fb.com \
--cc=keescook@chromium.org \
--cc=kuba@kernel.org \
--cc=linmiaohe@huawei.com \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=zhang.lin16@zte.com.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).