lkml.org 
[lkml]   [2023]   [Dec]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
SubjectRe: [syzbot] [arm-msm?] [net?] memory leak in radix_tree_insert
From
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: [arm-msm?] [net?] memory leak in radix_tree_insert
Author: eadavis@qq.com

please test memory leak in radix_tree_insert

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 33cc938e65a9

diff --git a/include/linux/radix-tree.h b/include/linux/radix-tree.h
index eae67015ce51..cc3e9fc7bae0 100644
--- a/include/linux/radix-tree.h
+++ b/include/linux/radix-tree.h
@@ -254,6 +254,7 @@ unsigned int radix_tree_gang_lookup_tag_slot(const struct radix_tree_root *,
void __rcu ***results, unsigned long first_index,
unsigned int max_items, unsigned int tag);
int radix_tree_tagged(const struct radix_tree_root *, unsigned int tag);
+unsigned long radix_tree_maxindex(const struct radix_tree_root *root);

static inline void radix_tree_preload_end(void)
{
diff --git a/lib/radix-tree.c b/lib/radix-tree.c
index b98e9f2c24ac..a89df8afa510 100644
--- a/lib/radix-tree.c
+++ b/lib/radix-tree.c
@@ -404,6 +404,18 @@ static unsigned radix_tree_load_root(const struct radix_tree_root *root,
return 0;
}

+unsigned long radix_tree_maxindex(const struct radix_tree_root *root)
+{
+ struct radix_tree_node *node = rcu_dereference_raw(root->xa_head);
+
+ if (likely(radix_tree_is_internal_node(node))) {
+ node = entry_to_node(node);
+ return node_maxindex(node);
+ }
+
+ return 0;
+}
+
/*
* Extend a radix tree so it can store key @index.
*/
diff --git a/net/qrtr/af_qrtr.c b/net/qrtr/af_qrtr.c
index 41ece61eb57a..abdae567a370 100644
--- a/net/qrtr/af_qrtr.c
+++ b/net/qrtr/af_qrtr.c
@@ -344,6 +344,12 @@ static int qrtr_node_enqueue(struct qrtr_node *node, struct sk_buff *skb,
struct qrtr_hdr_v1 *hdr;
size_t len = skb->len;
int rc, confirm_rx;
+ unsigned long maxidx;
+
+ if (to->sq_node == QRTR_NODE_BCAST) {
+ maxidx = radix_tree_maxindex(&node->qrtr_tx_flow);
+ to->sq_node = maxidx + 1;
+ }

confirm_rx = qrtr_tx_wait(node, to->sq_node, to->sq_port, type);
if (confirm_rx < 0) {
\
 
 \ /
  Last update: 2023-12-10 07:08    [W:0.284 / U:0.016 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site