Skip to content
Snippets Groups Projects
  • Kevin Darbyshire-Bryant's avatar
    7a57e82f
    kernel: act_ctinfo: backport memory leak fix · 7a57e82f
    Kevin Darbyshire-Bryant authored
    
    [ Upstream commit 09d4f10a5e78d76a53e3e584f1e6a701b6d24108 ]
    
    Implement a cleanup method to properly free ci->params
    
    BUG: memory leak
    unreferenced object 0xffff88811746e2c0 (size 64):
     comm "syz-executor617", pid 7106, jiffies 4294943055 (age 14.250s)
     hex dump (first 32 bytes):
       00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
       c0 34 60 84 ff ff ff ff 00 00 00 00 00 00 00 00  .4`.............
     backtrace:
       [<0000000015aa236f>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
       [<0000000015aa236f>] slab_post_alloc_hook mm/slab.h:586 [inline]
       [<0000000015aa236f>] slab_alloc mm/slab.c:3320 [inline]
       [<0000000015aa236f>] kmem_cache_alloc_trace+0x145/0x2c0 mm/slab.c:3549
       [<000000002c946bd1>] kmalloc include/linux/slab.h:556 [inline]
       [<000000002c946bd1>] kzalloc include/linux/slab.h:670 [inline]
       [<000000002c946bd1>] tcf_ctinfo_init+0x21a/0x530 net/sched/act_ctinfo.c:236
       [<0000000086952cca>] tcf_action_init_1+0x400/0x5b0 net/sched/act_api.c:944
       [<000000005ab29bf8>] tcf_action_init+0x135/0x1c0 net/sched/act_api.c:1000
       [<00000000392f56f9>] tcf_action_add+0x9a/0x200 net/sched/act_api.c:1410
       [<0000000088f3c5dd>] tc_ctl_action+0x14d/0x1bb net/sched/act_api.c:1465
       [<000000006b39d986>] rtnetlink_rcv_msg+0x178/0x4b0 net/core/rtnetlink.c:5424
       [<00000000fd6ecace>] netlink_rcv_skb+0x61/0x170 net/netlink/af_netlink.c:2477
       [<0000000047493d02>] rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5442
       [<00000000bdcf8286>] netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline]
       [<00000000bdcf8286>] netlink_unicast+0x223/0x310 net/netlink/af_netlink.c:1328
       [<00000000fc5b92d9>] netlink_sendmsg+0x2c0/0x570 net/netlink/af_netlink.c:1917
       [<00000000da84d076>] sock_sendmsg_nosec net/socket.c:639 [inline]
       [<00000000da84d076>] sock_sendmsg+0x54/0x70 net/socket.c:659
       [<0000000042fb2eee>] ____sys_sendmsg+0x2d0/0x300 net/socket.c:2330
       [<000000008f23f67e>] ___sys_sendmsg+0x8a/0xd0 net/socket.c:2384
       [<00000000d838e4f6>] __sys_sendmsg+0x80/0xf0 net/socket.c:2417
       [<00000000289a9cb1>] __do_sys_sendmsg net/socket.c:2426 [inline]
       [<00000000289a9cb1>] __se_sys_sendmsg net/socket.c:2424 [inline]
       [<00000000289a9cb1>] __x64_sys_sendmsg+0x23/0x30 net/socket.c:2424
    
    Fixes: 24ec483cec98 ("net: sched: Introduce act_ctinfo action")
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
    Cc: Kevin 'ldir' Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
    Cc: Cong Wang <xiyou.wangcong@gmail.com>
    Cc: Toke Høiland-Jørgensen <toke@redhat.com>
    Acked-by: default avatarKevin 'ldir' Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    
    Signed-off-by: default avatarKevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
    7a57e82f
    History
    kernel: act_ctinfo: backport memory leak fix
    Kevin Darbyshire-Bryant authored
    
    [ Upstream commit 09d4f10a5e78d76a53e3e584f1e6a701b6d24108 ]
    
    Implement a cleanup method to properly free ci->params
    
    BUG: memory leak
    unreferenced object 0xffff88811746e2c0 (size 64):
     comm "syz-executor617", pid 7106, jiffies 4294943055 (age 14.250s)
     hex dump (first 32 bytes):
       00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
       c0 34 60 84 ff ff ff ff 00 00 00 00 00 00 00 00  .4`.............
     backtrace:
       [<0000000015aa236f>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
       [<0000000015aa236f>] slab_post_alloc_hook mm/slab.h:586 [inline]
       [<0000000015aa236f>] slab_alloc mm/slab.c:3320 [inline]
       [<0000000015aa236f>] kmem_cache_alloc_trace+0x145/0x2c0 mm/slab.c:3549
       [<000000002c946bd1>] kmalloc include/linux/slab.h:556 [inline]
       [<000000002c946bd1>] kzalloc include/linux/slab.h:670 [inline]
       [<000000002c946bd1>] tcf_ctinfo_init+0x21a/0x530 net/sched/act_ctinfo.c:236
       [<0000000086952cca>] tcf_action_init_1+0x400/0x5b0 net/sched/act_api.c:944
       [<000000005ab29bf8>] tcf_action_init+0x135/0x1c0 net/sched/act_api.c:1000
       [<00000000392f56f9>] tcf_action_add+0x9a/0x200 net/sched/act_api.c:1410
       [<0000000088f3c5dd>] tc_ctl_action+0x14d/0x1bb net/sched/act_api.c:1465
       [<000000006b39d986>] rtnetlink_rcv_msg+0x178/0x4b0 net/core/rtnetlink.c:5424
       [<00000000fd6ecace>] netlink_rcv_skb+0x61/0x170 net/netlink/af_netlink.c:2477
       [<0000000047493d02>] rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5442
       [<00000000bdcf8286>] netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline]
       [<00000000bdcf8286>] netlink_unicast+0x223/0x310 net/netlink/af_netlink.c:1328
       [<00000000fc5b92d9>] netlink_sendmsg+0x2c0/0x570 net/netlink/af_netlink.c:1917
       [<00000000da84d076>] sock_sendmsg_nosec net/socket.c:639 [inline]
       [<00000000da84d076>] sock_sendmsg+0x54/0x70 net/socket.c:659
       [<0000000042fb2eee>] ____sys_sendmsg+0x2d0/0x300 net/socket.c:2330
       [<000000008f23f67e>] ___sys_sendmsg+0x8a/0xd0 net/socket.c:2384
       [<00000000d838e4f6>] __sys_sendmsg+0x80/0xf0 net/socket.c:2417
       [<00000000289a9cb1>] __do_sys_sendmsg net/socket.c:2426 [inline]
       [<00000000289a9cb1>] __se_sys_sendmsg net/socket.c:2424 [inline]
       [<00000000289a9cb1>] __x64_sys_sendmsg+0x23/0x30 net/socket.c:2424
    
    Fixes: 24ec483cec98 ("net: sched: Introduce act_ctinfo action")
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
    Cc: Kevin 'ldir' Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
    Cc: Cong Wang <xiyou.wangcong@gmail.com>
    Cc: Toke Høiland-Jørgensen <toke@redhat.com>
    Acked-by: default avatarKevin 'ldir' Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    
    Signed-off-by: default avatarKevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>