Commit fe692370 authored by Eric Dumazet's avatar Eric Dumazet Committed by Kamal Mostafa

net: fix percpu memory leaks

commit 1d6119ba upstream.

This patch fixes following problems :

1) percpu_counter_init() can return an error, therefore
  init_frag_mem_limit() must propagate this error so that
  inet_frags_init_net() can do the same up to its callers.

2) If ip[46]_frags_ns_ctl_register() fail, we must unwind
   properly and free the percpu_counter.

Without this fix, we leave freed object in percpu_counters
global list (if CONFIG_HOTPLUG_CPU) leading to crashes.

This bug was detected by KASAN and syzkaller tool
(http://github.com/google/syzkaller)

Fixes: 6d7b857d ("net: use lib/percpu_counter API for fragmentation mem accounting")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
Cc: Jesper Dangaard Brouer <brouer@redhat.com>
Acked-by: default avatarHannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
parent b3e7af60
...@@ -108,7 +108,15 @@ struct inet_frags { ...@@ -108,7 +108,15 @@ struct inet_frags {
int inet_frags_init(struct inet_frags *); int inet_frags_init(struct inet_frags *);
void inet_frags_fini(struct inet_frags *); void inet_frags_fini(struct inet_frags *);
void inet_frags_init_net(struct netns_frags *nf); static inline int inet_frags_init_net(struct netns_frags *nf)
{
return percpu_counter_init(&nf->mem, 0, GFP_KERNEL);
}
static inline void inet_frags_uninit_net(struct netns_frags *nf)
{
percpu_counter_destroy(&nf->mem);
}
void inet_frags_exit_net(struct netns_frags *nf, struct inet_frags *f); void inet_frags_exit_net(struct netns_frags *nf, struct inet_frags *f);
void inet_frag_kill(struct inet_frag_queue *q, struct inet_frags *f); void inet_frag_kill(struct inet_frag_queue *q, struct inet_frags *f);
...@@ -154,11 +162,6 @@ static inline void add_frag_mem_limit(struct netns_frags *nf, int i) ...@@ -154,11 +162,6 @@ static inline void add_frag_mem_limit(struct netns_frags *nf, int i)
__percpu_counter_add(&nf->mem, i, frag_percpu_counter_batch); __percpu_counter_add(&nf->mem, i, frag_percpu_counter_batch);
} }
static inline void init_frag_mem_limit(struct netns_frags *nf)
{
percpu_counter_init(&nf->mem, 0, GFP_KERNEL);
}
static inline unsigned int sum_frag_mem_limit(struct netns_frags *nf) static inline unsigned int sum_frag_mem_limit(struct netns_frags *nf)
{ {
unsigned int res; unsigned int res;
......
...@@ -523,14 +523,19 @@ static int __net_init lowpan_frags_init_net(struct net *net) ...@@ -523,14 +523,19 @@ static int __net_init lowpan_frags_init_net(struct net *net)
{ {
struct netns_ieee802154_lowpan *ieee802154_lowpan = struct netns_ieee802154_lowpan *ieee802154_lowpan =
net_ieee802154_lowpan(net); net_ieee802154_lowpan(net);
int res;
ieee802154_lowpan->frags.high_thresh = IPV6_FRAG_HIGH_THRESH; ieee802154_lowpan->frags.high_thresh = IPV6_FRAG_HIGH_THRESH;
ieee802154_lowpan->frags.low_thresh = IPV6_FRAG_LOW_THRESH; ieee802154_lowpan->frags.low_thresh = IPV6_FRAG_LOW_THRESH;
ieee802154_lowpan->frags.timeout = IPV6_FRAG_TIMEOUT; ieee802154_lowpan->frags.timeout = IPV6_FRAG_TIMEOUT;
inet_frags_init_net(&ieee802154_lowpan->frags); res = inet_frags_init_net(&ieee802154_lowpan->frags);
if (res)
return lowpan_frags_ns_sysctl_register(net); return res;
res = lowpan_frags_ns_sysctl_register(net);
if (res)
inet_frags_uninit_net(&ieee802154_lowpan->frags);
return res;
} }
static void __net_exit lowpan_frags_exit_net(struct net *net) static void __net_exit lowpan_frags_exit_net(struct net *net)
......
...@@ -209,12 +209,6 @@ int inet_frags_init(struct inet_frags *f) ...@@ -209,12 +209,6 @@ int inet_frags_init(struct inet_frags *f)
} }
EXPORT_SYMBOL(inet_frags_init); EXPORT_SYMBOL(inet_frags_init);
void inet_frags_init_net(struct netns_frags *nf)
{
init_frag_mem_limit(nf);
}
EXPORT_SYMBOL(inet_frags_init_net);
void inet_frags_fini(struct inet_frags *f) void inet_frags_fini(struct inet_frags *f)
{ {
cancel_work_sync(&f->frags_work); cancel_work_sync(&f->frags_work);
......
...@@ -845,6 +845,8 @@ static void __init ip4_frags_ctl_register(void) ...@@ -845,6 +845,8 @@ static void __init ip4_frags_ctl_register(void)
static int __net_init ipv4_frags_init_net(struct net *net) static int __net_init ipv4_frags_init_net(struct net *net)
{ {
int res;
/* Fragment cache limits. /* Fragment cache limits.
* *
* The fragment memory accounting code, (tries to) account for * The fragment memory accounting code, (tries to) account for
...@@ -868,9 +870,13 @@ static int __net_init ipv4_frags_init_net(struct net *net) ...@@ -868,9 +870,13 @@ static int __net_init ipv4_frags_init_net(struct net *net)
*/ */
net->ipv4.frags.timeout = IP_FRAG_TIME; net->ipv4.frags.timeout = IP_FRAG_TIME;
inet_frags_init_net(&net->ipv4.frags); res = inet_frags_init_net(&net->ipv4.frags);
if (res)
return ip4_frags_ns_ctl_register(net); return res;
res = ip4_frags_ns_ctl_register(net);
if (res)
inet_frags_uninit_net(&net->ipv4.frags);
return res;
} }
static void __net_exit ipv4_frags_exit_net(struct net *net) static void __net_exit ipv4_frags_exit_net(struct net *net)
......
...@@ -649,12 +649,18 @@ void nf_ct_frag6_consume_orig(struct sk_buff *skb) ...@@ -649,12 +649,18 @@ void nf_ct_frag6_consume_orig(struct sk_buff *skb)
static int nf_ct_net_init(struct net *net) static int nf_ct_net_init(struct net *net)
{ {
int res;
net->nf_frag.frags.high_thresh = IPV6_FRAG_HIGH_THRESH; net->nf_frag.frags.high_thresh = IPV6_FRAG_HIGH_THRESH;
net->nf_frag.frags.low_thresh = IPV6_FRAG_LOW_THRESH; net->nf_frag.frags.low_thresh = IPV6_FRAG_LOW_THRESH;
net->nf_frag.frags.timeout = IPV6_FRAG_TIMEOUT; net->nf_frag.frags.timeout = IPV6_FRAG_TIMEOUT;
inet_frags_init_net(&net->nf_frag.frags); res = inet_frags_init_net(&net->nf_frag.frags);
if (res)
return nf_ct_frag6_sysctl_register(net); return res;
res = nf_ct_frag6_sysctl_register(net);
if (res)
inet_frags_uninit_net(&net->nf_frag.frags);
return res;
} }
static void nf_ct_net_exit(struct net *net) static void nf_ct_net_exit(struct net *net)
......
...@@ -710,13 +710,19 @@ static void ip6_frags_sysctl_unregister(void) ...@@ -710,13 +710,19 @@ static void ip6_frags_sysctl_unregister(void)
static int __net_init ipv6_frags_init_net(struct net *net) static int __net_init ipv6_frags_init_net(struct net *net)
{ {
int res;
net->ipv6.frags.high_thresh = IPV6_FRAG_HIGH_THRESH; net->ipv6.frags.high_thresh = IPV6_FRAG_HIGH_THRESH;
net->ipv6.frags.low_thresh = IPV6_FRAG_LOW_THRESH; net->ipv6.frags.low_thresh = IPV6_FRAG_LOW_THRESH;
net->ipv6.frags.timeout = IPV6_FRAG_TIMEOUT; net->ipv6.frags.timeout = IPV6_FRAG_TIMEOUT;
inet_frags_init_net(&net->ipv6.frags); res = inet_frags_init_net(&net->ipv6.frags);
if (res)
return ip6_frags_ns_sysctl_register(net); return res;
res = ip6_frags_ns_sysctl_register(net);
if (res)
inet_frags_uninit_net(&net->ipv6.frags);
return res;
} }
static void __net_exit ipv6_frags_exit_net(struct net *net) static void __net_exit ipv6_frags_exit_net(struct net *net)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment