mirror of
https://github.com/openwrt/openwrt.git
synced 2024-12-20 14:13:16 +00:00
7a57e82f28
[ Upstream commit 09d4f10a5e78d76a53e3e584f1e6a701b6d24108 ]
Implement a cleanup method to properly free ci->params
BUG: memory leak
unreferenced object 0xffff88811746e2c0 (size 64):
comm "syz-executor617", pid 7106, jiffies 4294943055 (age 14.250s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
c0 34 60 84 ff ff ff ff 00 00 00 00 00 00 00 00 .4`.............
backtrace:
[<0000000015aa236f>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
[<0000000015aa236f>] slab_post_alloc_hook mm/slab.h:586 [inline]
[<0000000015aa236f>] slab_alloc mm/slab.c:3320 [inline]
[<0000000015aa236f>] kmem_cache_alloc_trace+0x145/0x2c0 mm/slab.c:3549
[<000000002c946bd1>] kmalloc include/linux/slab.h:556 [inline]
[<000000002c946bd1>] kzalloc include/linux/slab.h:670 [inline]
[<000000002c946bd1>] tcf_ctinfo_init+0x21a/0x530 net/sched/act_ctinfo.c:236
[<0000000086952cca>] tcf_action_init_1+0x400/0x5b0 net/sched/act_api.c:944
[<000000005ab29bf8>] tcf_action_init+0x135/0x1c0 net/sched/act_api.c:1000
[<00000000392f56f9>] tcf_action_add+0x9a/0x200 net/sched/act_api.c:1410
[<0000000088f3c5dd>] tc_ctl_action+0x14d/0x1bb net/sched/act_api.c:1465
[<000000006b39d986>] rtnetlink_rcv_msg+0x178/0x4b0 net/core/rtnetlink.c:5424
[<00000000fd6ecace>] netlink_rcv_skb+0x61/0x170 net/netlink/af_netlink.c:2477
[<0000000047493d02>] rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5442
[<00000000bdcf8286>] netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline]
[<00000000bdcf8286>] netlink_unicast+0x223/0x310 net/netlink/af_netlink.c:1328
[<00000000fc5b92d9>] netlink_sendmsg+0x2c0/0x570 net/netlink/af_netlink.c:1917
[<00000000da84d076>] sock_sendmsg_nosec net/socket.c:639 [inline]
[<00000000da84d076>] sock_sendmsg+0x54/0x70 net/socket.c:659
[<0000000042fb2eee>] ____sys_sendmsg+0x2d0/0x300 net/socket.c:2330
[<000000008f23f67e>] ___sys_sendmsg+0x8a/0xd0 net/socket.c:2384
[<00000000d838e4f6>] __sys_sendmsg+0x80/0xf0 net/socket.c:2417
[<00000000289a9cb1>] __do_sys_sendmsg net/socket.c:2426 [inline]
[<00000000289a9cb1>] __se_sys_sendmsg net/socket.c:2424 [inline]
[<00000000289a9cb1>] __x64_sys_sendmsg+0x23/0x30 net/socket.c:2424
Fixes: 24ec483cec98 ("net: sched: Introduce act_ctinfo action")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: Kevin 'ldir' Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
Cc: Cong Wang <xiyou.wangcong@gmail.com>
Cc: Toke Høiland-Jørgensen <toke@redhat.com>
Acked-by: Kevin 'ldir' Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
|
||
|---|---|---|
| .. | ||
| 010-Kbuild-don-t-hardcode-path-to-awk-in-scripts-ld-vers.patch | ||
| 011-kbuild-export-SUBARCH.patch | ||
| 020-backport_netfilter_rtcache.patch | ||
| 047-v4.21-mtd-keep-original-flags-for-every-struct-mtd_info.patch | ||
| 048-v4.21-mtd-improve-calculating-partition-boundaries-when-ch.patch | ||
| 080-v5.1-0001-bcma-keep-a-direct-pointer-to-the-struct-device.patch | ||
| 080-v5.1-0002-bcma-use-dev_-printing-functions.patch | ||
| 095-Allow-class-e-address-assignment-via-ifconfig-ioctl.patch | ||
| 101-arm-cns3xxx-use-actual-size-reads-for-PCIe.patch | ||
| 200-v5.2-usb-dwc2-Set-lpm-mode-parameters-depend-on-HW-configuration.patch | ||
| 210-arm64-sve-Disentangle-uapi-asm-ptrace.h-from-uapi-as.patch | ||
| 343-netfilter-nft_flow_offload-handle-netdevice-events-f.patch | ||
| 370-netfilter-nf_flow_table-fix-offloaded-connection-tim.patch | ||
| 371-netfilter-nf_flow_table-fix-up-ct-state-of-flows-aft.patch | ||
| 380-v5.3-net-sched-Introduce-act_ctinfo-action.patch | ||
| 450-v5.0-mtd-spinand-winbond-Add-support-for-W25N01GV.patch | ||
| 451-v5.0-mtd-spinand-Add-initial-support-for-Toshiba-TC58CVG2.patch | ||
| 452-v5.0-mtd-spinand-add-support-for-GigaDevice-GD5FxGQ4xA.patch | ||
| 455-v5.1-mtd-spinand-Add-support-for-all-Toshiba-Memory-produ.patch | ||
| 456-v5.1-mtd-spinand-Add-support-for-GigaDevice-GD5F1GQ4UExxG.patch | ||
| 460-v5.0-mtd-spi-nor-Add-support-for-mx25u12835f.patch | ||
| 460-v5.3-mtd-spinand-Define-macros-for-page-read-ops-with-thr.patch | ||
| 461-v5.3-mtd-spinand-Add-support-for-two-byte-device-IDs.patch | ||
| 462-v5.3-mtd-spinand-Add-support-for-GigaDevice-GD5F1GQ4UFxxG.patch | ||
| 463-v5.3-mtd-spinand-Add-initial-support-for-Paragon-PN26G0xA.patch | ||
| 700-v5.1-net-phylink-only-call-mac_config-during-resolve-when.patch | ||
| 701-v5.2-net-phylink-ensure-inband-AN-works-correctly.patch | ||
| 702-v4.20-net-ethernet-Add-helper-for-MACs-which-support-asym-.patch | ||
| 703-v4.20-net-ethernet-Add-helper-for-set_pauseparam-for-Asym-.patch | ||
| 704-v4.20-net-phy-Stop-with-excessive-soft-reset.patch | ||
| 705-v5.1-net-phy-provide-full-set-of-accessor-functions-to-MM.patch | ||
| 706-v5.1-net-phy-add-register-modifying-helpers-returning-1-o.patch | ||
| 707-v5.1-net-phy-add-genphy_c45_check_and_restart_aneg.patch | ||
| 708-v5.3-net-phylink-remove-netdev-from-phylink-mii-ioctl-emu.patch | ||
| 709-v5.3-net-phylink-support-for-link-gpio-interrupt.patch | ||
| 710-v5.3-net-phy-allow-Clause-45-access-via-mii-ioctl.patch | ||
| 711-v5.3-net-sfp-add-mandatory-attach-detach-methods-for-sfp-.patch | ||
| 712-v5.3-net-sfp-remove-sfp-bus-use-of-netdevs.patch | ||
| 713-v5.2-net-phylink-avoid-reducing-support-mask.patch | ||
| 714-v5.3-net-sfp-Stop-SFP-polling-and-interrupt-handling-duri.patch | ||
| 715-v5.3-net-phylink-don-t-start-and-stop-SGMII-PHYs-in-SFP-m.patch | ||
| 716-v5.4-net-sfp-move-fwnode-parsing-into-sfp-bus-layer.patch | ||
| 717-v5.5-net-sfp-rework-upstream-interface.patch | ||
| 718-v5.5-net-sfp-fix-sfp_bus_put-kernel-documentation.patch | ||
| 719-v5.5-net-sfp-fix-sfp_bus_add_upstream-warning.patch | ||
| 720-v5.5-net-sfp-move-sfp-sub-state-machines-into-separate-fu.patch | ||
| 721-v5.5-net-sfp-move-tx-disable-on-device-down-to-main-state.patch | ||
| 722-v5.5-net-sfp-rename-sfp_sm_ins_next-as-sfp_sm_mod_next.patch | ||
| 723-v5.5-net-sfp-handle-module-remove-outside-state-machine.patch | ||
| 724-v5.5-net-sfp-rename-T_PROBE_WAIT-to-T_SERIAL.patch | ||
| 725-v5.5-net-sfp-parse-SFP-power-requirement-earlier.patch | ||
| 726-v5.5-net-sfp-avoid-power-switch-on-address-change-modules.patch | ||
| 727-v5.5-net-sfp-control-TX_DISABLE-and-phy-only-from-main-st.patch | ||
| 728-v5.5-net-sfp-split-the-PHY-probe-from-sfp_sm_mod_init.patch | ||
| 729-v5.5-net-sfp-eliminate-mdelay-from-PHY-probe.patch | ||
| 730-v5.5-net-sfp-allow-fault-processing-to-transition-to-othe.patch | ||
| 731-v5.5-net-sfp-ensure-TX_FAULT-has-deasserted-before-probin.patch | ||
| 732-v5.5-net-sfp-track-upstream-s-attachment-state-in-state-m.patch | ||
| 733-v5.5-net-sfp-split-power-mode-switching-from-probe.patch | ||
| 734-v5.5-net-sfp-move-module-insert-reporting-out-of-probe.patch | ||
| 735-v5.5-net-sfp-allow-sfp-to-probe-slow-to-initialise-GPON-m.patch | ||
| 736-v5.5-net-sfp-allow-modules-with-slow-diagnostics-to-probe.patch | ||
| 737-v5.5-net-phy-add-core-phylib-sfp-support.patch | ||
| 738-v5.5-net-phy-marvell10g-add-SFP-support.patch | ||
| 739-v5.5-net-phylink-update-to-use-phy_support_asym_pause.patch | ||
| 740-v5.5-net-phy-avoid-matching-all-ones-clause-45-PHY-IDs.patch | ||
| 741-v5.5-net-phylink-fix-link-mode-modification-in-PHY-mode.patch | ||
| 742-v5.5-net-sfp-add-support-for-module-quirks.patch | ||
| 743-v5.5-net-sfp-add-some-quirks-for-GPON-modules.patch | ||
| 744-v5.5-net-sfp-soft-status-and-control-support.patch | ||