From mboxrd@z Thu Jan 1 00:00:00 1970 From: Nikolay Aleksandrov Subject: Re: [PATCH] net: bridge: fix a memory leak in __vlan_add Date: Sun, 14 Oct 2018 18:33:42 +0300 Message-ID: <2badfb2b-0a50-4d18-cdb4-d894b4ef7bec@cumulusnetworks.com> References: <1539487305-12761-1-git-send-email-lirongqing@baidu.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Cc: Roopa Prabhu , bridge@lists.linux-foundation.org To: Li RongQing , netdev@vger.kernel.org Return-path: In-Reply-To: <1539487305-12761-1-git-send-email-lirongqing@baidu.com> Content-Language: en-US List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: bridge-bounces@lists.linux-foundation.org Errors-To: bridge-bounces@lists.linux-foundation.org List-Id: netdev.vger.kernel.org On 14/10/2018 06:21, Li RongQing wrote: > After per-port vlan stats, vlan stats should be released > when fail to add vlan > > Fixes: 9163a0fc1f0c0 ("net: bridge: add support for per-port vlan stats") > cc: Nikolay Aleksandrov > Signed-off-by: Zhang Yu > Signed-off-by: Li RongQing > --- > net/bridge/br_vlan.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c > index 9b707234e4ae..e08e269041dd 100644 > --- a/net/bridge/br_vlan.c > +++ b/net/bridge/br_vlan.c > @@ -305,6 +305,10 @@ static int __vlan_add(struct net_bridge_vlan *v, u16 flags) > if (masterv) { > br_vlan_put_master(masterv); > v->brvlan = NULL; > + > + if (masterv->stats != v->stats && v->stats) > + free_percpu(v->stats); > + v->stats = NULL; > } > } else { > br_switchdev_port_vlan_del(dev, v->vid); > Hi, Good catch, but the patch doesn't fix the bug entirely. The problem is that masterv can be created just for this vlan and the br_vlan_put_master() above can free it, so we can check a pointer that's not really up-to-date (and thus again leak memory). You should move the new code above the br_vlan_put_master() call. Also please tag the proper branch, this is for net-next, and CC all bridge maintainers (added Roopa). Thank you, Nik