kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-28 20:03:05 +00:00
Code Issues Releases Packages Activity
linux/drivers
History
Wang Yufen 1118b2049d net: tun: Fix memory leaks of napi_get_frags 
kmemleak reports after running test_progs:

unreferenced object 0xffff8881b1672dc0 (size 232):
  comm "test_progs", pid 394388, jiffies 4354712116 (age 841.975s)
  hex dump (first 32 bytes):
    e0 84 d7 a8 81 88 ff ff 80 2c 67 b1 81 88 ff ff  .........,g.....
    00 40 c5 9b 81 88 ff ff 00 00 00 00 00 00 00 00  .@..............
  backtrace:
    [<00000000c8f01748>] napi_skb_cache_get+0xd4/0x150
    [<0000000041c7fc09>] __napi_build_skb+0x15/0x50
    [<00000000431c7079>] __napi_alloc_skb+0x26e/0x540
    [<000000003ecfa30e>] napi_get_frags+0x59/0x140
    [<0000000099b2199e>] tun_get_user+0x183d/0x3bb0 [tun]
    [<000000008a5adef0>] tun_chr_write_iter+0xc0/0x1b1 [tun]
    [<0000000049993ff4>] do_iter_readv_writev+0x19f/0x320
    [<000000008f338ea2>] do_iter_write+0x135/0x630
    [<000000008a3377a4>] vfs_writev+0x12e/0x440
    [<00000000a6b5639a>] do_writev+0x104/0x280
    [<00000000ccf065d8>] do_syscall_64+0x3b/0x90
    [<00000000d776e329>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

The issue occurs in the following scenarios:
tun_get_user()
  napi_gro_frags()
    napi_frags_finish()
      case GRO_NORMAL:
        gro_normal_one()
          list_add_tail(&skb->list, &napi->rx_list);
          <-- While napi->rx_count < READ_ONCE(gro_normal_batch),
          <-- gro_normal_list() is not called, napi->rx_list is not empty
  <-- not ask to complete the gro work, will cause memory leaks in
  <-- following tun_napi_del()
...
tun_napi_del()
  netif_napi_del()
    __netif_napi_del()
    <-- &napi->rx_list is not empty, which caused memory leaks

To fix, add napi_complete() after napi_gro_frags().

Fixes: 90e33d4594 ("tun: enable napi_gro_frags() for TUN/TAP driver")
Signed-off-by: Wang Yufen <wangyufen@huawei.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
History 2022-11-04 10:56:22 +00:00
..
accessibility speakup_soft: Add direct module parameter 2022-09-01 16:59:59 +02:00
acpi ACPI and device properties fixes for 6.1-rc3 2022-10-28 16:48:29 -07:00
amba ARM: 9229/1: amba: Fix use-after-free in amba_read_periphid() 2022-08-30 11:12:52 +01:00
android Scheduler changes for v6.1: 2022-10-10 09:10:28 -07:00
ata ata: ahci_qoriq: Fix compilation warning 2022-10-18 08:02:14 +09:00
atm atm: idt77252: fix use-after-free bugs caused by tst_timer 2022-08-08 20:51:59 -07:00
auxdisplay i2c: Make remove callback return void 2022-08-16 12:46:26 +02:00
base ACPI and device properties fixes for 6.1-rc3 2022-10-28 16:48:29 -07:00
bcma Interrupt subsystem updates: 2022-10-12 10:23:24 -07:00
block block-6.1-2022-10-28 2022-10-29 18:06:52 -07:00
bluetooth Bluetooth: virtio_bt: Use skb_put to set length 2022-11-02 14:15:42 -07:00
bus Char/Misc and other driver changes for 6.1-rc1 2022-10-08 08:56:37 -07:00
cdrom block: remove blk_cleanup_disk 2022-06-28 06:33:15 -06:00
char random: use arch_get_random*_early() in random_init() 2022-10-29 00:24:03 +02:00
clk This is the final part of the clk patches for this merge window. 2022-10-16 11:08:19 -07:00
clocksource A boring time, timekeeping, timers update: 2022-10-10 10:16:00 -07:00
comedi comedi: convert sysfs snprintf to sysfs_emit 2022-09-09 10:37:52 +02:00
connector connector/cn_proc: Use task_is_in_init_pid_ns() 2022-01-26 18:57:09 -08:00
counter counter: 104-quad-8: Fix race getting function mode and direction 2022-10-23 20:39:26 -04:00
cpufreq cpufreq: intel_pstate: hybrid: Use known scaling factor for P-cores 2022-10-25 15:09:23 +02:00
cpuidle RISC-V Patches for the 6.1 Merge Window, Part 1 2022-10-09 13:24:01 -07:00
crypto This update includes the following changes: 2022-10-10 13:04:25 -07:00
cxl cxl/hdm: Fix skip allocations vs multiple pmem allocations 2022-08-05 16:11:38 -07:00
dax libnvdimm for 6.1 2022-10-14 18:41:41 -07:00
dca dca: Use PTR_ERR_OR_ZERO() to simplify code 2020-05-15 16:25:20 +02:00
devfreq PM / devfreq: rockchip-dfi: Fix an error message 2022-09-26 03:59:43 +09:00
dio drivers: dio: add missing iounmap() in dio_init() 2022-05-19 18:56:51 +02:00
dma treewide: use get_random_bytes() when possible 2022-10-11 17:42:58 -06:00
dma-buf whack-a-mole: cropped up open-coded file_inode() uses... 2022-10-06 17:22:11 -07:00
edac Merge patch series "Use composable cache instead of L2 cache" 2022-10-13 11:07:13 -07:00
eisa EISA: use DEVICE_ATTR_RO() helper macro 2021-06-04 15:28:34 +02:00
extcon Char/Misc and other driver changes for 6.1-rc1 2022-10-08 08:56:37 -07:00
firewire firewire: net: Make use of get_unaligned_be48(), put_unaligned_be48() 2022-07-28 22:21:54 -07:00
firmware efi: runtime: Don't assume virtual mappings are missing if VA == PA == 0 2022-10-21 11:09:41 +02:00
fpga Char/Misc and other driver changes for 6.1-rc1 2022-10-08 08:56:37 -07:00
fsi fsi: core: Check error number after calling ida_simple_get 2022-09-28 21:10:57 +09:30
gnss gnss: replace ida_simple API 2022-06-21 09:30:36 +02:00
gpio gpio: tegra: Convert to immutable irq chip 2022-10-20 13:47:54 +02:00
gpu drm-misc-fixes for v6.1-rc3: 2022-10-28 13:00:15 +10:00
greybus greybus: svc: clean up link configuration hack at hello 2022-02-04 15:27:44 +01:00
hid for-linus-2022102101 2022-10-21 17:41:57 -07:00
hsi HSI: nokia-modem: Replace of_gpio_count() by gpiod_count() 2022-09-20 17:29:29 +02:00
hte hte: Uninitialized variable in hte_ts_get() 2022-05-20 15:54:41 +02:00
hv hyperv-next for 6.1 2022-10-10 13:59:01 -07:00
hwmon - Use the correct CPU capability clearing function on the error path in 2022-10-23 10:01:34 -07:00
hwspinlock hwspinlock: qcom: Add support for mmio usage to sfpb-mutex 2022-07-16 21:47:44 -05:00
hwtracing coresight: cti: Fix hang in cti_disable_hw() 2022-10-25 19:08:07 +02:00
i2c i2c: mlxbf: depend on ACPI; clean away ifdeffage 2022-10-21 07:59:35 +02:00
i3c i3c: master: Remove the wrong place of reattach. 2022-10-12 23:45:29 +02:00
idle intel_idle: Add AlderLake-N support 2022-09-21 20:33:49 +02:00
iio iio: bmc150-accel-core: Fix unsafe buffer attributes 2022-10-17 08:51:26 +01:00
infiniband RDMA/qedr: clean up work queue on failure in qedr_alloc_resources() 2022-10-28 12:59:40 -03:00
input Input updates for 6.1 merge window: 2022-10-11 10:53:25 -07:00
interconnect Merge branch 'icc-ignore-return-val' into icc-next 2022-09-20 15:57:00 +03:00
iommu iommu/vt-d: Clean up si_domain in the init_dmars() error path 2022-10-21 10:49:35 +02:00
ipack Char/Misc and other driver changes for 6.1-rc1 2022-10-08 08:56:37 -07:00
irqchip Interrupt subsystem updates: 2022-10-12 10:23:24 -07:00
isdn isdn: mISDN: netjet: fix wrong check of device registration 2022-11-02 12:34:48 +00:00
leds leds: simatic-ipc-leds-gpio: fix incorrect LED to GPIO mapping 2022-10-24 11:32:10 +02:00
macintosh powerpc updates for 6.1 2022-10-09 14:05:15 -07:00
mailbox mailbox: qcom-ipcc: flag IRQ NO_THREAD 2022-10-05 21:51:58 -05:00
mcb drivers: mcb: directly use ida_alloc()/free() 2022-07-12 09:04:55 +02:00
md dm clone: Fix typo in block_device format specifier 2022-10-18 17:17:48 -04:00
media media: vivid: set num_in/outputs to 0 if not supported 2022-10-25 16:43:34 +01:00
memory Memory controller drivers for v6.1 - MediaTek 2022-09-12 17:04:15 +02:00
memstick MMC core: 2022-08-04 19:41:09 -07:00
message scsi: message: fusion: Remove redundant variable iocnum 2022-08-31 23:39:57 -04:00
mfd Revert "mfd: syscon: Remove repetition of the regmap_get_val_endian()" 2022-10-23 12:04:56 -07:00
misc misc: sgi-gru: use explicitly signed char 2022-10-25 19:12:10 +02:00
mmc mmc: sdhci_am654: 'select', not 'depends' REGMAP_MMIO 2022-10-26 11:48:03 +02:00
most most: usb: replace snprintf in show functions with sysfs_emit 2021-11-26 17:03:47 +01:00
mtd mtd: parsers: bcm47xxpart: Fix halfblock reads 2022-10-18 11:20:12 +02:00
mux mux: Fix struct mux_state kernel-doc comment 2022-02-04 15:47:12 +01:00
net net: tun: Fix memory leaks of napi_get_frags 2022-11-04 10:56:22 +00:00
nfc nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send() 2022-10-30 21:43:26 +00:00
ntb NTB: epf: Allow more flexibility in the memory BAR map method 2022-08-09 17:54:03 -04:00
nubus proc: remove PDE_DATA() completely 2022-01-22 08:33:37 +02:00
nvdimm libnvdimm for 6.1 2022-10-14 18:41:41 -07:00
nvme block-6.1-2022-10-28 2022-10-29 18:06:52 -07:00
nvmem nvmem: u-boot-env: fix crc32 casting type 2022-09-24 14:56:37 +02:00
of Devicetree updates for v6.1: 2022-10-10 13:13:51 -07:00
opp OPP: Fix an un-initialized variable usage 2022-08-16 10:48:08 +05:30
parisc parisc: Export iosapic_serial_irq() symbol for serial port driver 2022-10-27 09:12:05 +02:00
parport parport: add support for Netmos device 9900 2022-09-01 17:46:06 +02:00
pci Revert "PCI: tegra: Use PCI_CONF1_EXT_ADDRESS() macro" 2022-10-17 12:11:09 -05:00
pcmcia pcmcia: remove AT91RM9200 Compact Flash driver 2022-09-27 08:12:16 +02:00
peci peci: cpu: Fix use-after-free in adev_release() 2022-08-15 20:31:35 +02:00
perf arm64 fixes: 2022-10-14 12:38:03 -07:00
phy pci-v6.1-changes 2022-10-11 11:08:18 -07:00
pinctrl pinctrl: ocelot: Fix incorrect trigger of the interrupt. 2022-10-18 10:42:10 +02:00
platform LoongArch fixes for v6.1-rc3 2022-10-30 09:44:06 -07:00
pnp Merge branches 'acpi-apei', 'acpi-wakeup', 'acpi-reboot' and 'acpi-thermal' 2022-10-10 18:11:11 +02:00
power power supply and reset changes for the v6.1 series 2022-10-07 11:48:30 -07:00
powercap Scheduler changes for v6.1: 2022-10-10 09:10:28 -07:00
pps pps: generators: pps_gen_parport: Switch to use module_parport_driver() 2022-03-18 14:01:19 +01:00
ps3 powerpc/ps3: Warn on PS3 device errors 2021-06-10 21:44:58 +10:00
ptp ] ptp: ocp: remove symlink for second GNSS 2022-10-10 08:37:24 +01:00
pwm pwm: Changes for v6.1-rc1 2022-10-07 11:32:10 -07:00
rapidio rapidio: remove unnecessary use of list iterator 2022-04-29 14:38:03 -07:00
ras RAS/CEC: Reduce offline page threshold for Intel systems 2022-08-22 19:30:02 +02:00
regulator - Core Frameworks 2022-10-07 11:24:20 -07:00
remoteproc remoteproc: virtio: Fix warning on bindings by removing the of_match_table 2022-10-05 09:20:44 -06:00
reset Here's the main clk pull request for this merge window. We have some 2022-10-08 10:06:48 -07:00
rpmsg rpmsg: char: Avoid double destroy of default endpoint 2022-09-21 11:21:33 -06:00
rtc rtc: cmos: fix build on non-ACPI platforms 2022-10-18 22:36:54 +02:00
s390 s390/vfio-ap: Fix memory allocation for mdev_types array 2022-10-26 14:47:31 +02:00
sbus module: remove never implemented MODULE_SUPPORTED_DEVICE 2021-03-17 13:16:18 -07:00
scsi SCSI fixes on 20221028 2022-10-29 18:12:45 -07:00
sh genirq: Add and use an irq_data_update_affinity helper 2022-07-07 09:38:04 +01:00
siox bus: Make remove callback return void 2021-07-21 11:53:42 +02:00
slimbus slimbus: qcom-ngd: Add error handling in of_qcom_slim_ngd_register 2022-09-24 14:53:06 +02:00
soc Merge patch series "Use composable cache instead of L2 cache" 2022-10-13 11:07:13 -07:00
soundwire soundwire updates for 6.1-rc1 2022-10-07 16:13:55 -07:00
spi spi: Fixes for v6.1 2022-10-26 17:38:46 -07:00
spmi spmi: pmic-arb: increase SPMI transaction timeout delay 2022-09-30 14:33:23 +02:00
ssb ssb: gpio: Use generic_handle_irq_safe() 2022-09-19 15:08:38 +02:00
staging media fixes for v6.1-rc2 2022-10-22 15:30:15 -07:00
target Merge branch '6.1/scsi-queue' into 6.1/scsi-fixes 2022-10-21 01:10:34 +00:00
tc The main MIPS changes for 5.6: 2020-01-31 11:28:31 -08:00
tee - Yu Zhao's Multi-Gen LRU patches are here. They've been under test in 2022-10-10 17:53:04 -07:00
thermal thermal: intel_powerclamp: Use first online CPU as control_cpu 2022-10-15 19:33:57 +02:00
thunderbolt treewide: use get_random_u32() when possible 2022-10-11 17:42:58 -06:00
tty parisc/serial: Rename 8250_gsc.c to 8250_parisc.c 2022-10-21 08:10:46 +02:00
ufs scsi: ufs: core: Fix typo in comment 2022-10-22 03:29:32 +00:00
uio uio: dfl: add IOPLL user-clock feature id 2022-09-01 17:00:33 +02:00
usb fbdev fixes for kernel 6.1-rc3: 2022-10-30 11:31:14 -07:00
vdpa virtio: fixes, features 2022-10-10 14:02:53 -07:00
vfio VFIO updates for v6.1-rc1 2022-10-12 14:46:48 -07:00
vhost virtio: fixes, features 2022-10-10 14:02:53 -07:00
video fbdev fixes for kernel 6.1-rc3: 2022-10-30 11:31:14 -07:00
virt Char/Misc and other driver changes for 6.1-rc1 2022-10-08 08:56:37 -07:00
virtio virtio_pci: use irq to detect interrupt support 2022-10-13 09:33:03 -04:00
vlynq bus: Make remove callback return void 2021-07-21 11:53:42 +02:00
w1 Char/Misc and other driver changes for 6.1-rc1 2022-10-08 08:56:37 -07:00
watchdog linux-watchdog 6.1-rc4 tag 2022-11-01 12:21:53 -07:00
xen xen: branch for v6.1-rc2 2022-10-21 14:43:09 -07:00
zorro proc: remove PDE_DATA() completely 2022-01-22 08:33:37 +02:00
Kconfig vme: move back to staging 2022-06-10 15:38:14 +02:00
Makefile hwtracing: hisi_ptt: Add trace function support for HiSilicon PCIe Tune and Trace device 2022-09-08 16:26:17 -06:00