• Mao Wenan's avatar
    net: hsr: fix memory leak in hsr_dev_finalize() · 6caabe7f
    Mao Wenan authored
    If hsr_add_port(hsr, hsr_dev, HSR_PT_MASTER) failed to
    add port, it directly returns res and forgets to free the node
    that allocated in hsr_create_self_node(), and forgets to delete
    the node->mac_list linked in hsr->self_node_db.
    
    BUG: memory leak
    unreferenced object 0xffff8881cfa0c780 (size 64):
      comm "syz-executor.0", pid 2077, jiffies 4294717969 (age 2415.377s)
      hex dump (first 32 bytes):
        e0 c7 a0 cf 81 88 ff ff 00 02 00 00 00 00 ad de  ................
        00 e6 49 cd 81 88 ff ff c0 9b 87 d0 81 88 ff ff  ..I.............
      backtrace:
        [<00000000e2ff5070>] hsr_dev_finalize+0x736/0x960 [hsr]
        [<000000003ed2e597>] hsr_newlink+0x2b2/0x3e0 [hsr]
        [<000000003fa8c6b6>] __rtnl_newlink+0xf1f/0x1600 net/core/rtnetlink.c:3182
        [<000000001247a7ad>] rtnl_newlink+0x66/0x90 net/core/rtnetlink.c:3240
        [<00000000e7d1b61d>] rtnetlink_rcv_msg+0x54e/0xb90 net/core/rtnetlink.c:5130
        [<000000005556bd3a>] netlink_rcv_skb+0x129/0x340 net/netlink/af_netlink.c:2477
        [<00000000741d5ee6>] netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]
        [<00000000741d5ee6>] netlink_unicast+0x49a/0x650 net/netlink/af_netlink.c:1336
        [<000000009d56f9b7>] netlink_sendmsg+0x88b/0xdf0 net/netlink/af_netlink.c:1917
        [<0000000046b35c59>] sock_sendmsg_nosec net/socket.c:621 [inline]
        [<0000000046b35c59>] sock_sendmsg+0xc3/0x100 net/socket.c:631
        [<00000000d208adc9>] __sys_sendto+0x33e/0x560 net/socket.c:1786
        [<00000000b582837a>] __do_sys_sendto net/socket.c:1798 [inline]
        [<00000000b582837a>] __se_sys_sendto net/socket.c:1794 [inline]
        [<00000000b582837a>] __x64_sys_sendto+0xdd/0x1b0 net/socket.c:1794
        [<00000000c866801d>] do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
        [<00000000fea382d9>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
        [<00000000e01dacb3>] 0xffffffffffffffff
    
    Fixes: c5a75911 ("net/hsr: Use list_head (and rcu) instead of array for slave devices.")
    Reported-by: default avatarHulk Robot <hulkci@huawei.com>
    Signed-off-by: default avatarMao Wenan <maowenan@huawei.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    6caabe7f
hsr_framereg.c 13.7 KB