From patchwork Tue Jul 11 21:55:12 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eduardo Valentin X-Patchwork-Id: 786871 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3x6bWv2VQDz9s74 for ; Wed, 12 Jul 2017 07:56:43 +1000 (AEST) Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=amazon.com header.i=@amazon.com header.b="IUolNwId"; dkim-atps=neutral Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934196AbdGKV42 (ORCPT ); Tue, 11 Jul 2017 17:56:28 -0400 Received: from smtp-fw-9101.amazon.com ([207.171.184.25]:24762 "EHLO smtp-fw-9101.amazon.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933186AbdGKV41 (ORCPT ); Tue, 11 Jul 2017 17:56:27 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1499810187; x=1531346187; h=from:to:cc:subject:date:message-id:mime-version; bh=7Kdiuze8jY+mlwS1m3aNqPBkz/yF7ZTZLF7z/Ld6N84=; b=IUolNwIdngBzAPTupmVkrbFkV2orZllZ8OX26mXuiXSwMuPxacIpzaQL mp8p7hvYPQC4O4iAaQc4JvOpiSyYBoU5yQugqAlv0fIu8ewIqnokgHYsc 2e4pT/T4q2MtIHbgsL+PthWRlwlkC1uNnfgagLUxjC4m1OGM/YWgADMHo 8=; X-IronPort-AV: E=Sophos;i="5.40,347,1496102400"; d="scan'208";a="691922852" Received: from sea19-co-svc-lb5-vlan2.sea.amazon.com (HELO email-inbound-relay-64017.pdx4.amazon.com) ([10.47.22.162]) by smtp-border-fw-out-9101.sea19.amazon.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 11 Jul 2017 21:55:37 +0000 Received: from EX13MTAUWC001.ant.amazon.com (pdx1-ws-svc-p6-lb9-vlan2.pdx.amazon.com [10.236.137.194]) by email-inbound-relay-64017.pdx4.amazon.com (8.14.7/8.14.7) with ESMTP id v6BLtSt1003114 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 11 Jul 2017 21:55:29 GMT Received: from EX13D05UWC001.ant.amazon.com (10.43.162.82) by EX13MTAUWC001.ant.amazon.com (10.43.162.135) with Microsoft SMTP Server (TLS) id 15.0.1104.5; Tue, 11 Jul 2017 21:55:29 +0000 Received: from EX13MTAUWC001.ant.amazon.com (10.43.162.135) by EX13D05UWC001.ant.amazon.com (10.43.162.82) with Microsoft SMTP Server (TLS) id 15.0.1104.5; Tue, 11 Jul 2017 21:55:28 +0000 Received: from localhost (172.26.140.69) by mail-relay.amazon.com (10.43.162.232) with Microsoft SMTP Server id 15.0.1104.5 via Frontend Transport; Tue, 11 Jul 2017 21:55:28 +0000 From: Eduardo Valentin To: Stephen Hemminger , "David S . Miller" CC: , , , Eduardo Valentin , "stable # v4 . 9+" Subject: [PATCH 1/1] bridge: mdb: fix leak on complete_info ptr on fail path Date: Tue, 11 Jul 2017 14:55:12 -0700 Message-ID: <1499810112-11790-1-git-send-email-eduval@amazon.com> X-Mailer: git-send-email 2.7.4 MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org We currently get the following kmemleak report: unreferenced object 0xffff8800039d9820 (size 32): comm "softirq", pid 0, jiffies 4295212383 (age 792.416s) hex dump (first 32 bytes): 00 0c e0 03 00 88 ff ff ff 02 00 00 00 00 00 00 ................ 00 00 00 01 ff 11 00 02 86 dd 00 00 ff ff ff ff ................ backtrace: [] kmemleak_alloc+0x4a/0xa0 [] kmem_cache_alloc_trace+0xb8/0x1c0 [] __br_mdb_notify+0x2a3/0x300 [bridge] [] br_mdb_notify+0x6e/0x70 [bridge] [] br_multicast_add_group+0x109/0x150 [bridge] [] br_ip6_multicast_add_group+0x58/0x60 [bridge] [] br_multicast_rcv+0x1d5/0xdb0 [bridge] [] br_handle_frame_finish+0xcf/0x510 [bridge] [] br_nf_hook_thresh.part.27+0xb/0x10 [br_netfilter] [] br_nf_hook_thresh+0x48/0xb0 [br_netfilter] [] br_nf_pre_routing_finish_ipv6+0x109/0x1d0 [br_netfilter] [] br_nf_pre_routing_ipv6+0xd0/0x14c [br_netfilter] [] br_nf_pre_routing+0x197/0x3d0 [br_netfilter] [] nf_iterate+0x52/0x60 [] nf_hook_slow+0x5c/0xb0 [] br_handle_frame+0x1a4/0x2c0 [bridge] This happens when switchdev_port_obj_add() fails. This patch frees complete_info object in the fail path. Cc: stable # v4.9+ Reviewed-by: Vallish Vaidyeshwara Signed-off-by: Eduardo Valentin --- net/bridge/br_mdb.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/bridge/br_mdb.c b/net/bridge/br_mdb.c index b084548..c1030f8 100644 --- a/net/bridge/br_mdb.c +++ b/net/bridge/br_mdb.c @@ -323,7 +323,8 @@ static void __br_mdb_notify(struct net_device *dev, struct net_bridge_port *p, __mdb_entry_to_br_ip(entry, &complete_info->ip); mdb.obj.complete_priv = complete_info; mdb.obj.complete = br_mdb_complete; - switchdev_port_obj_add(port_dev, &mdb.obj); + if (switchdev_port_obj_add(port_dev, &mdb.obj)) + kfree(complete_info); } } else if (port_dev && type == RTM_DELMDB) { switchdev_port_obj_del(port_dev, &mdb.obj);