996ee1aca7
[ Upstream commit 6caabe7f197d3466d238f70915d65301f1716626 ]
If hsr_add_port(hsr, hsr_dev, HSR_PT_MASTER) failed to
add port, it directly returns res and forgets to free the node
that allocated in hsr_create_self_node(), and forgets to delete
the node->mac_list linked in hsr->self_node_db.
BUG: memory leak
unreferenced object 0xffff8881cfa0c780 (size 64):
comm "syz-executor.0", pid 2077, jiffies 4294717969 (age 2415.377s)
hex dump (first 32 bytes):
e0 c7 a0 cf 81 88 ff ff 00 02 00 00 00 00 ad de ................
00 e6 49 cd 81 88 ff ff c0 9b 87 d0 81 88 ff ff ..I.............
backtrace:
[<00000000e2ff5070>] hsr_dev_finalize+0x736/0x960 [hsr]
[<000000003ed2e597>] hsr_newlink+0x2b2/0x3e0 [hsr]
[<000000003fa8c6b6>] __rtnl_newlink+0xf1f/0x1600 net/core/rtnetlink.c:3182
[<000000001247a7ad>] rtnl_newlink+0x66/0x90 net/core/rtnetlink.c:3240
[<00000000e7d1b61d>] rtnetlink_rcv_msg+0x54e/0xb90 net/core/rtnetlink.c:5130
[<000000005556bd3a>] netlink_rcv_skb+0x129/0x340 net/netlink/af_netlink.c:2477
[<00000000741d5ee6>] netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]
[<00000000741d5ee6>] netlink_unicast+0x49a/0x650 net/netlink/af_netlink.c:1336
[<000000009d56f9b7>] netlink_sendmsg+0x88b/0xdf0 net/netlink/af_netlink.c:1917
[<0000000046b35c59>] sock_sendmsg_nosec net/socket.c:621 [inline]
[<0000000046b35c59>] sock_sendmsg+0xc3/0x100 net/socket.c:631
[<00000000d208adc9>] __sys_sendto+0x33e/0x560 net/socket.c:1786
[<00000000b582837a>] __do_sys_sendto net/socket.c:1798 [inline]
[<00000000b582837a>] __se_sys_sendto net/socket.c:1794 [inline]
[<00000000b582837a>] __x64_sys_sendto+0xdd/0x1b0 net/socket.c:1794
[<00000000c866801d>] do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
[<00000000fea382d9>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[<00000000e01dacb3>] 0xffffffffffffffff
Fixes: c5a7591172 ("net/hsr: Use list_head (and rcu) instead of array for slave devices.")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Mao Wenan <maowenan@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
55 lines
1.8 KiB
C
55 lines
1.8 KiB
C
/* Copyright 2011-2014 Autronica Fire and Security AS
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify it
|
|
* under the terms of the GNU General Public License as published by the Free
|
|
* Software Foundation; either version 2 of the License, or (at your option)
|
|
* any later version.
|
|
*
|
|
* Author(s):
|
|
* 2011-2014 Arvid Brodin, arvid.brodin@alten.se
|
|
*/
|
|
|
|
#ifndef __HSR_FRAMEREG_H
|
|
#define __HSR_FRAMEREG_H
|
|
|
|
#include "hsr_main.h"
|
|
|
|
struct hsr_node;
|
|
|
|
void hsr_del_node(struct list_head *self_node_db);
|
|
struct hsr_node *hsr_add_node(struct list_head *node_db, unsigned char addr[],
|
|
u16 seq_out);
|
|
struct hsr_node *hsr_get_node(struct hsr_port *port, struct sk_buff *skb,
|
|
bool is_sup);
|
|
void hsr_handle_sup_frame(struct sk_buff *skb, struct hsr_node *node_curr,
|
|
struct hsr_port *port);
|
|
bool hsr_addr_is_self(struct hsr_priv *hsr, unsigned char *addr);
|
|
|
|
void hsr_addr_subst_source(struct hsr_node *node, struct sk_buff *skb);
|
|
void hsr_addr_subst_dest(struct hsr_node *node_src, struct sk_buff *skb,
|
|
struct hsr_port *port);
|
|
|
|
void hsr_register_frame_in(struct hsr_node *node, struct hsr_port *port,
|
|
u16 sequence_nr);
|
|
int hsr_register_frame_out(struct hsr_port *port, struct hsr_node *node,
|
|
u16 sequence_nr);
|
|
|
|
void hsr_prune_nodes(struct timer_list *t);
|
|
|
|
int hsr_create_self_node(struct list_head *self_node_db,
|
|
unsigned char addr_a[ETH_ALEN],
|
|
unsigned char addr_b[ETH_ALEN]);
|
|
|
|
void *hsr_get_next_node(struct hsr_priv *hsr, void *_pos,
|
|
unsigned char addr[ETH_ALEN]);
|
|
|
|
int hsr_get_node_data(struct hsr_priv *hsr,
|
|
const unsigned char *addr,
|
|
unsigned char addr_b[ETH_ALEN],
|
|
unsigned int *addr_b_ifindex,
|
|
int *if1_age,
|
|
u16 *if1_seq,
|
|
int *if2_age,
|
|
u16 *if2_seq);
|
|
|
|
#endif /* __HSR_FRAMEREG_H */
|