Re: [PATCH net] net: ipv4: fix one memleak in __inet_del_ifa()

[Zhu Yanjun <yanjun.zhu@linux.dev>]

在 2023/9/5 21:55, Liu Jian 写道:
> I got the below warning when do fuzzing test:
> unregister_netdevice: waiting for bond0 to become free. Usage count = 2
> 
> It can be repoduced via:
> 
> ip link add bond0 type bond
> sysctl -w net.ipv4.conf.bond0.promote_secondaries=1
> ip addr add 4.117.174.103/0 scope 0x40 dev bond0
> ip addr add 192.168.100.111/255.255.255.254 scope 0 dev bond0
> ip addr add 0.0.0.4/0 scope 0x40 secondary dev bond0
> ip addr del 4.117.174.103/0 scope 0x40 dev bond0
> ip link delete bond0 type bond
> 
> In this reproduction test case, an incorrect 'last_prim' is found in
> __inet_del_ifa(), as a result, the secondary address(0.0.0.4/0 scope 0x40)
> is lost. The memory of the secondary address is leaked and the reference of
> in_device and net_device is leaked.
> 
> Fix this problem by modifying the PROMOTE_SECONDANCE behavior as follows:
> 1. Traverse in_dev->ifa_list to search for the actual 'last_prim'.
> 2. When last_prim is empty, move 'promote' to the in_dev->ifa_list header.
> 
> Fixes: 0ff60a45678e ("[IPV4]: Fix secondary IP addresses after promotion")
> Signed-off-by: Liu Jian <liujian56@huawei.com>
> ---
>   net/ipv4/devinet.c | 26 ++++++++++++++++++++------
>   1 file changed, 20 insertions(+), 6 deletions(-)
> 
> diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
> index 9cf64ee47dd2..99278f4b58e0 100644
> --- a/net/ipv4/devinet.c
> +++ b/net/ipv4/devinet.c
> @@ -355,14 +355,13 @@ static void __inet_del_ifa(struct in_device *in_dev,
>   {
>   	struct in_ifaddr *promote = NULL;
>   	struct in_ifaddr *ifa, *ifa1;
> -	struct in_ifaddr *last_prim;
> +	struct in_ifaddr *last_prim = NULL;
>   	struct in_ifaddr *prev_prom = NULL;
>   	int do_promote = IN_DEV_PROMOTE_SECONDARIES(in_dev);
>   
>   	ASSERT_RTNL();
>   
>   	ifa1 = rtnl_dereference(*ifap);
> -	last_prim = rtnl_dereference(in_dev->ifa_list);
>   	if (in_dev->dead)
>   		goto no_promotions;
>   
> @@ -371,7 +370,16 @@ static void __inet_del_ifa(struct in_device *in_dev,
>   	 **/
>   
>   	if (!(ifa1->ifa_flags & IFA_F_SECONDARY)) {
> -		struct in_ifaddr __rcu **ifap1 = &ifa1->ifa_next;
> +		struct in_ifaddr __rcu **ifap1 = &in_dev->ifa_list;
> +
> +		while ((ifa = rtnl_dereference(*ifap1)) != NULL) {

while ((ifa = rtnl_dereference(*ifap1))) should be enough.

Zhu Yanjun

> +			if (ifa1 == ifa)
> +				break;
> +			last_prim = ifa;
> +			ifap1 = &ifa->ifa_next;
> +		}
> +
> +		ifap1 = &ifa1->ifa_next;
>   
>   		while ((ifa = rtnl_dereference(*ifap1)) != NULL) {
>   			if (!(ifa->ifa_flags & IFA_F_SECONDARY) &&
> @@ -440,9 +448,15 @@ static void __inet_del_ifa(struct in_device *in_dev,
>   
>   			rcu_assign_pointer(prev_prom->ifa_next, next_sec);
>   
> -			last_sec = rtnl_dereference(last_prim->ifa_next);
> -			rcu_assign_pointer(promote->ifa_next, last_sec);
> -			rcu_assign_pointer(last_prim->ifa_next, promote);
> +			if (last_prim) {
> +				last_sec = rtnl_dereference(last_prim->ifa_next);
> +				rcu_assign_pointer(promote->ifa_next, last_sec);
> +				rcu_assign_pointer(last_prim->ifa_next, promote);
> +			} else {
> +				rcu_assign_pointer(promote->ifa_next,
> +						   rtnl_dereference(in_dev->ifa_list));
> +				rcu_assign_pointer(in_dev->ifa_list, promote);
> +			}
>   		}
>   
>   		promote->ifa_flags &= ~IFA_F_SECONDARY;