From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AH8x224ok+ELNehUpqLlrq93tlM9eKpq3rsXXTtuChHeeHD7F6Aml1jHsZBoL7GqKifBMUYoke/E ARC-Seal: i=1; a=rsa-sha256; t=1517256645; cv=none; d=google.com; s=arc-20160816; b=CDmY2Dz7QLQRDOPmXBlMk0unwd6mSiRqW6Xfq60/8XeIZ4MyN602+/KhPdTRBulVHc kalD8jBPGFtlBCXN60PYwvbGY5keOpbBQRVVGl3doeikLI0K4sNqd79g+yPMbeihe3M5 c9WDCzcXT6suupnm6//b9IbGvGX5jAlHDV8liwmRghvnyXL28Lg4QQLXn+G8eYNvTflS ls87N9pV7MzkZUY51HrheuqDh7hTqdtV98Sbpds3qYpiNMgPwwmn3vBzRKpKOsHQmpzm CZczZ3Sc7DLpN4dhGApSt+g36Z0dJyeL2tbjGlct4XUtpwh4mg0e2KaBRc0D8yO2pOd4 UueQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:user-agent:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=sJuienFAliHeEyGVaY6YH0hTJKEUwkeeujWQHJiF80s=; b=Up+737odoHY1FYObscL20t8pk59clkYfOUUW1IDPye7f3afkzAjuQketIkIdQ54TKx 79hTD0sx912Nc46BgI4wplF6ZZEuKMA9n29HGwMO1q2GeiYyoGXPX6LEyUOwTtBuz9ni ZZsx3F6tpUY21WkoLMrxk0mAAijycEJ/4pAaNTSYhz7S/7UCf0d7DSwVvC92V1UnTd4K jsSWFLVrSAWo4g0ABnW+sVOyWsP5vAZC6hwYiysPcJR8uMtBlZSeLrXjoq97NF2yetJB JdsBuawc6M6TuQWtPXfNfo1GJtJjbZiymfO+9wUUlkFgosdLdC/AZeB5/PhLkLBMVQJN TATw== ARC-Authentication-Results: i=1; mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dmitry Vyukov , Jason Wang , Cong Wang , "David S. Miller" Subject: [PATCH 4.14 47/71] tun: fix a memory leak for tfile->tx_array Date: Mon, 29 Jan 2018 13:57:15 +0100 Message-Id: <20180129123830.359300819@linuxfoundation.org> X-Mailer: git-send-email 2.16.1 In-Reply-To: <20180129123827.271171825@linuxfoundation.org> References: <20180129123827.271171825@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-LABELS: =?utf-8?b?IlxcU2VudCI=?= X-GMAIL-THRID: =?utf-8?q?1590958628395807783?= X-GMAIL-MSGID: =?utf-8?q?1590958904956914989?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: 4.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Cong Wang [ Upstream commit 4df0bfc79904b7169dc77dcce44598b1545721f9 ] tfile->tun could be detached before we close the tun fd, via tun_detach_all(), so it should not be used to check for tfile->tx_array. As Jason suggested, we probably have to clean it up unconditionally both in __tun_deatch() and tun_detach_all(), but this requires to check if it is initialized or not. Currently skb_array_cleanup() doesn't have such a check, so I check it in the caller and introduce a helper function, it is a bit ugly but we can always improve it in net-next. Reported-by: Dmitry Vyukov Fixes: 1576d9860599 ("tun: switch to use skb array for tx") Cc: Jason Wang Signed-off-by: Cong Wang Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- drivers/net/tun.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -534,6 +534,14 @@ static void tun_queue_purge(struct tun_f skb_queue_purge(&tfile->sk.sk_error_queue); } +static void tun_cleanup_tx_array(struct tun_file *tfile) +{ + if (tfile->tx_array.ring.queue) { + skb_array_cleanup(&tfile->tx_array); + memset(&tfile->tx_array, 0, sizeof(tfile->tx_array)); + } +} + static void __tun_detach(struct tun_file *tfile, bool clean) { struct tun_file *ntfile; @@ -575,8 +583,7 @@ static void __tun_detach(struct tun_file tun->dev->reg_state == NETREG_REGISTERED) unregister_netdevice(tun->dev); } - if (tun) - skb_array_cleanup(&tfile->tx_array); + tun_cleanup_tx_array(tfile); sock_put(&tfile->sk); } } @@ -616,11 +623,13 @@ static void tun_detach_all(struct net_de /* Drop read queue */ tun_queue_purge(tfile); sock_put(&tfile->sk); + tun_cleanup_tx_array(tfile); } list_for_each_entry_safe(tfile, tmp, &tun->disabled, next) { tun_enable_queue(tfile); tun_queue_purge(tfile); sock_put(&tfile->sk); + tun_cleanup_tx_array(tfile); } BUG_ON(tun->numdisabled != 0); @@ -2624,6 +2633,8 @@ static int tun_chr_open(struct inode *in sock_set_flag(&tfile->sk, SOCK_ZEROCOPY); + memset(&tfile->tx_array, 0, sizeof(tfile->tx_array)); + return 0; }