lkml.org 
[lkml]   [2021]   [Jun]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 36/90] net: hamradio: fix memory leak in mkiss_close
    Date
    From: Pavel Skripkin <paskripkin@gmail.com>

    [ Upstream commit 7edcc682301492380fbdd604b4516af5ae667a13 ]

    My local syzbot instance hit memory leak in
    mkiss_open()[1]. The problem was in missing
    free_netdev() in mkiss_close().

    In mkiss_open() netdevice is allocated and then
    registered, but in mkiss_close() netdevice was
    only unregistered, but not freed.

    Fail log:

    BUG: memory leak
    unreferenced object 0xffff8880281ba000 (size 4096):
    comm "syz-executor.1", pid 11443, jiffies 4295046091 (age 17.660s)
    hex dump (first 32 bytes):
    61 78 30 00 00 00 00 00 00 00 00 00 00 00 00 00 ax0.............
    00 27 fa 2a 80 88 ff ff 00 00 00 00 00 00 00 00 .'.*............
    backtrace:
    [<ffffffff81a27201>] kvmalloc_node+0x61/0xf0
    [<ffffffff8706e7e8>] alloc_netdev_mqs+0x98/0xe80
    [<ffffffff84e64192>] mkiss_open+0xb2/0x6f0 [1]
    [<ffffffff842355db>] tty_ldisc_open+0x9b/0x110
    [<ffffffff84236488>] tty_set_ldisc+0x2e8/0x670
    [<ffffffff8421f7f3>] tty_ioctl+0xda3/0x1440
    [<ffffffff81c9f273>] __x64_sys_ioctl+0x193/0x200
    [<ffffffff8911263a>] do_syscall_64+0x3a/0xb0
    [<ffffffff89200068>] entry_SYSCALL_64_after_hwframe+0x44/0xae

    BUG: memory leak
    unreferenced object 0xffff8880141a9a00 (size 96):
    comm "syz-executor.1", pid 11443, jiffies 4295046091 (age 17.660s)
    hex dump (first 32 bytes):
    e8 a2 1b 28 80 88 ff ff e8 a2 1b 28 80 88 ff ff ...(.......(....
    98 92 9c aa b0 40 02 00 00 00 00 00 00 00 00 00 .....@..........
    backtrace:
    [<ffffffff8709f68b>] __hw_addr_create_ex+0x5b/0x310
    [<ffffffff8709fb38>] __hw_addr_add_ex+0x1f8/0x2b0
    [<ffffffff870a0c7b>] dev_addr_init+0x10b/0x1f0
    [<ffffffff8706e88b>] alloc_netdev_mqs+0x13b/0xe80
    [<ffffffff84e64192>] mkiss_open+0xb2/0x6f0 [1]
    [<ffffffff842355db>] tty_ldisc_open+0x9b/0x110
    [<ffffffff84236488>] tty_set_ldisc+0x2e8/0x670
    [<ffffffff8421f7f3>] tty_ioctl+0xda3/0x1440
    [<ffffffff81c9f273>] __x64_sys_ioctl+0x193/0x200
    [<ffffffff8911263a>] do_syscall_64+0x3a/0xb0
    [<ffffffff89200068>] entry_SYSCALL_64_after_hwframe+0x44/0xae

    BUG: memory leak
    unreferenced object 0xffff8880219bfc00 (size 512):
    comm "syz-executor.1", pid 11443, jiffies 4295046091 (age 17.660s)
    hex dump (first 32 bytes):
    00 a0 1b 28 80 88 ff ff 80 8f b1 8d ff ff ff ff ...(............
    80 8f b1 8d ff ff ff ff 00 00 00 00 00 00 00 00 ................
    backtrace:
    [<ffffffff81a27201>] kvmalloc_node+0x61/0xf0
    [<ffffffff8706eec7>] alloc_netdev_mqs+0x777/0xe80
    [<ffffffff84e64192>] mkiss_open+0xb2/0x6f0 [1]
    [<ffffffff842355db>] tty_ldisc_open+0x9b/0x110
    [<ffffffff84236488>] tty_set_ldisc+0x2e8/0x670
    [<ffffffff8421f7f3>] tty_ioctl+0xda3/0x1440
    [<ffffffff81c9f273>] __x64_sys_ioctl+0x193/0x200
    [<ffffffff8911263a>] do_syscall_64+0x3a/0xb0
    [<ffffffff89200068>] entry_SYSCALL_64_after_hwframe+0x44/0xae

    BUG: memory leak
    unreferenced object 0xffff888029b2b200 (size 256):
    comm "syz-executor.1", pid 11443, jiffies 4295046091 (age 17.660s)
    hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
    backtrace:
    [<ffffffff81a27201>] kvmalloc_node+0x61/0xf0
    [<ffffffff8706f062>] alloc_netdev_mqs+0x912/0xe80
    [<ffffffff84e64192>] mkiss_open+0xb2/0x6f0 [1]
    [<ffffffff842355db>] tty_ldisc_open+0x9b/0x110
    [<ffffffff84236488>] tty_set_ldisc+0x2e8/0x670
    [<ffffffff8421f7f3>] tty_ioctl+0xda3/0x1440
    [<ffffffff81c9f273>] __x64_sys_ioctl+0x193/0x200
    [<ffffffff8911263a>] do_syscall_64+0x3a/0xb0
    [<ffffffff89200068>] entry_SYSCALL_64_after_hwframe+0x44/0xae

    Fixes: 815f62bf7427 ("[PATCH] SMP rewrite of mkiss")
    Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/hamradio/mkiss.c | 1 +
    1 file changed, 1 insertion(+)

    diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c
    index deef14215110..352f9e75954c 100644
    --- a/drivers/net/hamradio/mkiss.c
    +++ b/drivers/net/hamradio/mkiss.c
    @@ -800,6 +800,7 @@ static void mkiss_close(struct tty_struct *tty)
    ax->tty = NULL;

    unregister_netdev(ax->dev);
    + free_netdev(ax->dev);
    }

    /* Perform I/O control on an active ax25 channel. */
    --
    2.30.2


    \
     
     \ /
      Last update: 2021-06-21 18:20    [W:2.868 / U:0.104 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site