From patchwork Fri Feb 3 21:20:47 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Luis Chamberlain X-Patchwork-Id: 723933 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3vFVCm24cMz9s77 for ; Sat, 4 Feb 2017 08:21:08 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752610AbdBCVUz (ORCPT ); Fri, 3 Feb 2017 16:20:55 -0500 Received: from mail.kernel.org ([198.145.29.136]:37498 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752384AbdBCVUy (ORCPT ); Fri, 3 Feb 2017 16:20:54 -0500 Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id B122420382; Fri, 3 Feb 2017 21:20:52 +0000 (UTC) Received: from garbanzo.do-not-panic.com (c-73-15-241-2.hsd1.ca.comcast.net [73.15.241.2]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 8A4DA20380; Fri, 3 Feb 2017 21:20:51 +0000 (UTC) From: "Luis R. Rodriguez" To: davem@davemloft.net, kuznet@ms2.inr.ac.ru, jmorris@namei.org, yoshfuji@linux-ipv6.org Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, "Luis R. Rodriguez" Subject: [RFC] igmp: address pmc kmemleak from on igmpv3_del_delrec() Date: Fri, 3 Feb 2017 13:20:47 -0800 Message-Id: <20170203212047.31653-1-mcgrof@kernel.org> X-Mailer: git-send-email 2.11.0 X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org When we igmpv3_add_delrec() we kzalloc the pmc, but when users call igmpv3_del_delrec() we never free the pmc. This was caught by the following kmemleak splat: unreferenced object 0xffff99666ff43b40 (size 192): comm "systemd-resolve", pid 1258, jiffies 4309905600 (age 2138.352s) hex dump (first 32 bytes): 00 6a 64 72 66 99 ff ff e0 00 00 fc 00 00 00 00 .jdrf........... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [] kmemleak_alloc+0x4a/0xa0 [] kmem_cache_alloc_trace+0x107/0x240 [] igmp_group_dropped+0xfd/0x270 [] ip_mc_dec_group+0xaf/0x110 [] ip_mc_leave_group+0xb6/0x140 [] do_ip_setsockopt.isra.13+0x4c7/0xed0 [] ip_setsockopt+0x34/0xb0 [] udp_setsockopt+0x1b/0x30 [] sock_common_setsockopt+0x14/0x20 [] SyS_setsockopt+0x80/0xe0 [] do_syscall_64+0x5b/0xc0 [] return_from_SYSCALL_64+0x0/0x6a [] 0xffffffffffffffff Signed-off-by: Luis R. Rodriguez --- I can reproduce this over time on a qemu box running next-20170125. After running this for a while I no longer see the splat. This needs confirmation form folks more familiar with the code, hence RFC. If this is a real fix we need appropriate tags for the patch. net/ipv4/igmp.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c index 5b15459955f8..44fd86de2823 100644 --- a/net/ipv4/igmp.c +++ b/net/ipv4/igmp.c @@ -1172,6 +1172,7 @@ static void igmpv3_del_delrec(struct in_device *in_dev, struct ip_mc_list *im) psf->sf_crcount = im->crcount; } in_dev_put(pmc->interface); + kfree(pmc); } spin_unlock_bh(&im->lock); }