lkml.org 
[lkml]   [2021]   [Jul]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 046/108] net: sched: fix memory leak in tcindex_partial_destroy_work
    Date
    From: Pavel Skripkin <paskripkin@gmail.com>

    [ Upstream commit f5051bcece50140abd1a11a2d36dc3ec5484fc32 ]

    Syzbot reported memory leak in tcindex_set_parms(). The problem was in
    non-freed perfect hash in tcindex_partial_destroy_work().

    In tcindex_set_parms() new tcindex_data is allocated and some fields from
    old one are copied to new one, but not the perfect hash. Since
    tcindex_partial_destroy_work() is the destroy function for old
    tcindex_data, we need to free perfect hash to avoid memory leak.

    Reported-and-tested-by: syzbot+f0bbb2287b8993d4fa74@syzkaller.appspotmail.com
    Fixes: 331b72922c5f ("net: sched: RCU cls_tcindex")
    Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/sched/cls_tcindex.c | 5 ++++-
    1 file changed, 4 insertions(+), 1 deletion(-)

    diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c
    index 3e81f87d0c89..684187a1fdb9 100644
    --- a/net/sched/cls_tcindex.c
    +++ b/net/sched/cls_tcindex.c
    @@ -278,6 +278,8 @@ static int tcindex_filter_result_init(struct tcindex_filter_result *r,
    TCA_TCINDEX_POLICE);
    }

    +static void tcindex_free_perfect_hash(struct tcindex_data *cp);
    +
    static void tcindex_partial_destroy_work(struct work_struct *work)
    {
    struct tcindex_data *p = container_of(to_rcu_work(work),
    @@ -285,7 +287,8 @@ static void tcindex_partial_destroy_work(struct work_struct *work)
    rwork);

    rtnl_lock();
    - kfree(p->perfect);
    + if (p->perfect)
    + tcindex_free_perfect_hash(p);
    kfree(p);
    rtnl_unlock();
    }
    --
    2.30.2


    \
     
     \ /
      Last update: 2021-07-26 18:12    [W:4.249 / U:0.196 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site