• Yang Yingliang's avatar
    net/802/mrp: fix memleak in mrp_request_join() · 996af621
    Yang Yingliang authored
    I got kmemleak report when doing fuzz test:
    
    BUG: memory leak
    unreferenced object 0xffff88810c239500 (size 64):
    comm "syz-executor940", pid 882, jiffies 4294712870 (age 14.631s)
    hex dump (first 32 bytes):
    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
    00 00 00 00 00 00 00 00 01 00 00 00 01 02 00 04 ................
    backtrace:
    [<00000000a323afa4>] slab_alloc_node mm/slub.c:2972 [inline]
    [<00000000a323afa4>] slab_alloc mm/slub.c:2980 [inline]
    [<00000000a323afa4>] __kmalloc+0x167/0x340 mm/slub.c:4130
    [<000000005034ca11>] kmalloc include/linux/slab.h:595 [inline]
    [<000000005034ca11>] mrp_attr_create net/802/mrp.c:276 [inline]
    [<000000005034ca11>] mrp_request_join+0x265/0x550 net/802/mrp.c:530
    [<00000000fcfd81f3>] vlan_mvrp_request_join+0x145/0x170 net/8021q/vlan_mvrp.c:40
    [<000000009258546e>] vlan_dev_open+0x477/0x890 net/8021q/vlan_dev.c:292
    [<0000000059acd82b>] __dev_open+0x281/0x410 net/core/dev.c:1609
    [<000000004e6dc695>] __dev_change_flags+0x424/0x560 net/core/dev.c:8767
    [<00000000471a09af>] rtnl_configure_link+0xd9/0x210 net/core/rtnetlink.c:3122
    [<0000000037a4672b>] __rtnl_newlink+0xe08/0x13e0 net/core/rtnetlink.c:3448
    [<000000008d5d0fda>] rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3488
    [<000000004882fe39>] rtnetlink_rcv_msg+0x369/0xa10 net/core/rtnetlink.c:5552
    [<00000000907e6c54>] netlink_rcv_skb+0x134/0x3d0 net/netlink/af_netlink.c:2504
    [<00000000e7d7a8c4>] netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
    [<00000000e7d7a8c4>] netlink_unicast+0x4a0/0x6a0 net/netlink/af_netlink.c:1340
    [<00000000e0645d50>] netlink_sendmsg+0x78e/0xc90 net/netlink/af_netlink.c:1929
    [<00000000c24559b7>] sock_sendmsg_nosec net/socket.c:654 [inline]
    [<00000000c24559b7>] sock_sendmsg+0x139/0x170 net/socket.c:674
    [<00000000fc210bc2>] ____sys_sendmsg+0x658/0x7d0 net/socket.c:2350
    [<00000000be4577b5>] ___sys_sendmsg+0xf8/0x170 net/socket.c:2404
    
    Calling mrp_request_leave() after mrp_request_join(), the attr->state
    is set to MRP_APPLICANT_VO, mrp_attr_destroy() won't be called in last
    TX event in mrp_uninit_applicant(), the attr of applicant will be leaked.
    To fix this leak, iterate and free each attr of applicant before rerturning
    from mrp_uninit_applicant().
    Reported-by: default avatarHulk Robot <hulkci@huawei.com>
    Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    996af621
mrp.c 24.8 KB