* [PATCH net] bridge: Fix memory leak in br_dev_xmit
@ 2014-03-28 6:21 Toshiaki Makita
2014-03-28 16:34 ` Stephen Hemminger
0 siblings, 1 reply; 4+ messages in thread
From: Toshiaki Makita @ 2014-03-28 6:21 UTC (permalink / raw)
To: David S . Miller, Stephen Hemminger; +Cc: Vlad Yasevich, netdev, bridge
When a frame is rejected by br_allowed_ingress(), the skb is not freed.
Signed-off-by: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
---
net/bridge/br_device.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 8fe8b71..b152fb6 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -55,7 +55,7 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
skb_pull(skb, ETH_HLEN);
if (!br_allowed_ingress(br, br_get_vlan_info(br), skb, &vid))
- goto out;
+ goto drop;
if (is_broadcast_ether_addr(dest))
br_flood_deliver(br, skb, false);
@@ -64,10 +64,8 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
br_flood_deliver(br, skb, false);
goto out;
}
- if (br_multicast_rcv(br, NULL, skb, vid)) {
- kfree_skb(skb);
- goto out;
- }
+ if (br_multicast_rcv(br, NULL, skb, vid))
+ goto drop;
mdst = br_mdb_get(br, skb, vid);
if ((mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb)) &&
@@ -83,6 +81,9 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
out:
rcu_read_unlock();
return NETDEV_TX_OK;
+drop:
+ kfree_skb(skb);
+ goto out;
}
static int br_dev_init(struct net_device *dev)
--
1.8.1.2
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH net] bridge: Fix memory leak in br_dev_xmit
2014-03-28 6:21 [PATCH net] bridge: Fix memory leak in br_dev_xmit Toshiaki Makita
@ 2014-03-28 16:34 ` Stephen Hemminger
2014-03-29 7:40 ` Toshiaki Makita
0 siblings, 1 reply; 4+ messages in thread
From: Stephen Hemminger @ 2014-03-28 16:34 UTC (permalink / raw)
To: Toshiaki Makita; +Cc: Vlad Yasevich, netdev, bridge, David S . Miller
On Fri, 28 Mar 2014 15:21:19 +0900
Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp> wrote:
> When a frame is rejected by br_allowed_ingress(), the skb is not freed.
>
> Signed-off-by: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
> ---
> net/bridge/br_device.c | 11 ++++++-----
> 1 file changed, 6 insertions(+), 5 deletions(-)
>
> diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
> index 8fe8b71..b152fb6 100644
> --- a/net/bridge/br_device.c
> +++ b/net/bridge/br_device.c
> @@ -55,7 +55,7 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
> skb_pull(skb, ETH_HLEN);
>
> if (!br_allowed_ingress(br, br_get_vlan_info(br), skb, &vid))
> - goto out;
> + goto drop;
>
> if (is_broadcast_ether_addr(dest))
> br_flood_deliver(br, skb, false);
> @@ -64,10 +64,8 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
> br_flood_deliver(br, skb, false);
> goto out;
> }
> - if (br_multicast_rcv(br, NULL, skb, vid)) {
> - kfree_skb(skb);
> - goto out;
> - }
> + if (br_multicast_rcv(br, NULL, skb, vid))
> + goto drop;
>
> mdst = br_mdb_get(br, skb, vid);
> if ((mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb)) &&
> @@ -83,6 +81,9 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
> out:
> rcu_read_unlock();
> return NETDEV_TX_OK;
> +drop:
> + kfree_skb(skb);
> + goto out;
> }
Increment dev->tx_dropped?
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH net] bridge: Fix memory leak in br_dev_xmit
2014-03-28 16:34 ` Stephen Hemminger
@ 2014-03-29 7:40 ` Toshiaki Makita
2014-03-30 2:41 ` Toshiaki Makita
0 siblings, 1 reply; 4+ messages in thread
From: Toshiaki Makita @ 2014-03-29 7:40 UTC (permalink / raw)
To: Stephen Hemminger
Cc: Toshiaki Makita, Vlad Yasevich, netdev, bridge, David S . Miller
On Fri, 2014-03-28 at 09:34 -0700, Stephen Hemminger wrote:
> On Fri, 28 Mar 2014 15:21:19 +0900
> Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp> wrote:
>
> > When a frame is rejected by br_allowed_ingress(), the skb is not freed.
> >
...
> Increment dev->tx_dropped?
OK, I'll rework it.
Thanks,
Toshiaki Makita
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH net] bridge: Fix memory leak in br_dev_xmit
2014-03-29 7:40 ` Toshiaki Makita
@ 2014-03-30 2:41 ` Toshiaki Makita
0 siblings, 0 replies; 4+ messages in thread
From: Toshiaki Makita @ 2014-03-30 2:41 UTC (permalink / raw)
To: Stephen Hemminger; +Cc: Vlad Yasevich, netdev, bridge, David S . Miller
On Sat, 2014-03-29 at 16:40 +0900, Toshiaki Makita wrote:
> On Fri, 2014-03-28 at 09:34 -0700, Stephen Hemminger wrote:
> > On Fri, 28 Mar 2014 15:21:19 +0900
> > Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp> wrote:
> >
> > > When a frame is rejected by br_allowed_ingress(), the skb is not freed.
> > >
> ...
> > Increment dev->tx_dropped?
>
> OK, I'll rework it.
After investigating bridge codes, I found br_cpu_netstats doesn't have
tx_dropped field.
I'm thinking about adding that field, but it seems to be appropriate for
net-next. I'm resending this patch as is for now.
Thanks,
Toshiaki Makita
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2014-03-30 2:41 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-03-28 6:21 [PATCH net] bridge: Fix memory leak in br_dev_xmit Toshiaki Makita
2014-03-28 16:34 ` Stephen Hemminger
2014-03-29 7:40 ` Toshiaki Makita
2014-03-30 2:41 ` Toshiaki Makita
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).