• Yang Yingliang's avatar
    net: fix memleak in register_netdevice() · 814152a8
    Yang Yingliang authored
    I got a memleak report when doing some fuzz test:
    
    unreferenced object 0xffff888112584000 (size 13599):
      comm "ip", pid 3048, jiffies 4294911734 (age 343.491s)
      hex dump (first 32 bytes):
        74 61 70 30 00 00 00 00 00 00 00 00 00 00 00 00  tap0............
        00 ee d9 19 81 88 ff ff 00 00 00 00 00 00 00 00  ................
      backtrace:
        [<000000002f60ba65>] __kmalloc_node+0x309/0x3a0
        [<0000000075b211ec>] kvmalloc_node+0x7f/0xc0
        [<00000000d3a97396>] alloc_netdev_mqs+0x76/0xfc0
        [<00000000609c3655>] __tun_chr_ioctl+0x1456/0x3d70
        [<000000001127ca24>] ksys_ioctl+0xe5/0x130
        [<00000000b7d5e66a>] __x64_sys_ioctl+0x6f/0xb0
        [<00000000e1023498>] do_syscall_64+0x56/0xa0
        [<000000009ec0eb12>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
    unreferenced object 0xffff888111845cc0 (size 8):
      comm "ip", pid 3048, jiffies 4294911734 (age 343.491s)
      hex dump (first 8 bytes):
        74 61 70 30 00 88 ff ff                          tap0....
      backtrace:
        [<000000004c159777>] kstrdup+0x35/0x70
        [<00000000d8b496ad>] kstrdup_const+0x3d/0x50
        [<00000000494e884a>] kvasprintf_const+0xf1/0x180
        [<0000000097880a2b>] kobject_set_name_vargs+0x56/0x140
        [<000000008fbdfc7b>] dev_set_name+0xab/0xe0
        [<000000005b99e3b4>] netdev_register_kobject+0xc0/0x390
        [<00000000602704fe>] register_netdevice+0xb61/0x1250
        [<000000002b7ca244>] __tun_chr_ioctl+0x1cd1/0x3d70
        [<000000001127ca24>] ksys_ioctl+0xe5/0x130
        [<00000000b7d5e66a>] __x64_sys_ioctl+0x6f/0xb0
        [<00000000e1023498>] do_syscall_64+0x56/0xa0
        [<000000009ec0eb12>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
    unreferenced object 0xffff88811886d800 (size 512):
      comm "ip", pid 3048, jiffies 4294911734 (age 343.491s)
      hex dump (first 32 bytes):
        00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00  .....N..........
        ff ff ff ff ff ff ff ff c0 66 3d a3 ff ff ff ff  .........f=.....
      backtrace:
        [<0000000050315800>] device_add+0x61e/0x1950
        [<0000000021008dfb>] netdev_register_kobject+0x17e/0x390
        [<00000000602704fe>] register_netdevice+0xb61/0x1250
        [<000000002b7ca244>] __tun_chr_ioctl+0x1cd1/0x3d70
        [<000000001127ca24>] ksys_ioctl+0xe5/0x130
        [<00000000b7d5e66a>] __x64_sys_ioctl+0x6f/0xb0
        [<00000000e1023498>] do_syscall_64+0x56/0xa0
        [<000000009ec0eb12>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
    
    If call_netdevice_notifiers() failed, then rollback_registered()
    calls netdev_unregister_kobject() which holds the kobject. The
    reference cannot be put because the netdev won't be add to todo
    list, so it will leads a memleak, we need put the reference to
    avoid memleak.
    Reported-by: default avatarHulk Robot <hulkci@huawei.com>
    Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    814152a8
dev.c 266 KB