From mboxrd@z Thu Jan 1 00:00:00 1970 From: Cong Wang Subject: [Patch net v2] tun: fix a memory leak for tfile->tx_array Date: Wed, 10 Jan 2018 10:51:01 -0800 Message-ID: <20180110185101.25964-1-xiyou.wangcong@gmail.com> Cc: dvyukov@google.com, Cong Wang , Jason Wang To: netdev@vger.kernel.org Return-path: Received: from mail-pg0-f66.google.com ([74.125.83.66]:35832 "EHLO mail-pg0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752823AbeAJSvQ (ORCPT ); Wed, 10 Jan 2018 13:51:16 -0500 Received: by mail-pg0-f66.google.com with SMTP id d6so10522146pgv.2 for ; Wed, 10 Jan 2018 10:51:16 -0800 (PST) Sender: netdev-owner@vger.kernel.org List-ID: tfile->tun could be detached before we close the tun fd, via tun_detach_all(), so it should not be used to check for tfile->tx_array. As Jason suggested, we probably have to clean it up unconditionally, but this requires to check if it is initialized or not. Currently skb_array_cleanup() doesn't have such a check, so I check it in the caller, it is ugly but we can always improve it in net-next. Reported-by: Dmitry Vyukov Fixes: 1576d9860599 ("tun: switch to use skb array for tx") Cc: Jason Wang Signed-off-by: Cong Wang --- drivers/net/tun.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/tun.c b/drivers/net/tun.c index 4f4a842a1c9c..4c85474ffbaf 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -657,7 +657,7 @@ static void __tun_detach(struct tun_file *tfile, bool clean) tun->dev->reg_state == NETREG_REGISTERED) unregister_netdevice(tun->dev); } - if (tun) + if (tfile->tx_array.ring.queue) skb_array_cleanup(&tfile->tx_array); sock_put(&tfile->sk); } @@ -2851,6 +2851,8 @@ static int tun_chr_open(struct inode *inode, struct file * file) sock_set_flag(&tfile->sk, SOCK_ZEROCOPY); + memset(&tfile->tx_array, 0, sizeof(tfile->tx_array)); + return 0; } -- 2.13.0