Commit 1d6119ba authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

net: fix percpu memory leaks 

This patch fixes following problems :

1) percpu_counter_init() can return an error, therefore
  init_frag_mem_limit() must propagate this error so that
  inet_frags_init_net() can do the same up to its callers.

2) If ip[46]_frags_ns_ctl_register() fail, we must unwind
   properly and free the percpu_counter.

Without this fix, we leave freed object in percpu_counters
global list (if CONFIG_HOTPLUG_CPU) leading to crashes.

This bug was detected by KASAN and syzkaller tool
(http://github.com/google/syzkaller

)

Fixes: 6d7b857d ("net: use lib/percpu_counter API for fragmentation mem accounting")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
Cc: Jesper Dangaard Brouer <brouer@redhat.com>
Acked-by: default avatarHannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent c4511132

include/net/inet_frag.h

+9 −6
Original line number Diff line number Diff line
@@ -108,7 +108,15 @@ struct inet_frags { 
int inet_frags_init(struct inet_frags *);

void inet_frags_fini(struct inet_frags *);



void inet_frags_init_net(struct netns_frags *nf);

static inline int inet_frags_init_net(struct netns_frags *nf)

{

	return percpu_counter_init(&nf->mem, 0, GFP_KERNEL);

}

static inline void inet_frags_uninit_net(struct netns_frags *nf)

{

	percpu_counter_destroy(&nf->mem);

}



void inet_frags_exit_net(struct netns_frags *nf, struct inet_frags *f);



void inet_frag_kill(struct inet_frag_queue *q, struct inet_frags *f);
@@ -154,11 +162,6 @@ static inline void add_frag_mem_limit(struct netns_frags *nf, int i) 
	__percpu_counter_add(&nf->mem, i, frag_percpu_counter_batch);

}



static inline void init_frag_mem_limit(struct netns_frags *nf)

{

	percpu_counter_init(&nf->mem, 0, GFP_KERNEL);

}



static inline unsigned int sum_frag_mem_limit(struct netns_frags *nf)

{

	unsigned int res;

net/ieee802154/6lowpan/reassembly.c

+8 −3
Original line number Diff line number Diff line
@@ -580,14 +580,19 @@ static int __net_init lowpan_frags_init_net(struct net *net) 
{

	struct netns_ieee802154_lowpan *ieee802154_lowpan =

		net_ieee802154_lowpan(net);

	int res;



	ieee802154_lowpan->frags.high_thresh = IPV6_FRAG_HIGH_THRESH;

	ieee802154_lowpan->frags.low_thresh = IPV6_FRAG_LOW_THRESH;

	ieee802154_lowpan->frags.timeout = IPV6_FRAG_TIMEOUT;



	inet_frags_init_net(&ieee802154_lowpan->frags);



	return lowpan_frags_ns_sysctl_register(net);

	res = inet_frags_init_net(&ieee802154_lowpan->frags);

	if (res)

		return res;

	res = lowpan_frags_ns_sysctl_register(net);

	if (res)

		inet_frags_uninit_net(&ieee802154_lowpan->frags);

	return res;

}



static void __net_exit lowpan_frags_exit_net(struct net *net)

net/ipv4/inet_fragment.c

+0 −6
Original line number Diff line number Diff line
@@ -209,12 +209,6 @@ int inet_frags_init(struct inet_frags *f) 
}

EXPORT_SYMBOL(inet_frags_init);



void inet_frags_init_net(struct netns_frags *nf)

{

	init_frag_mem_limit(nf);

}

EXPORT_SYMBOL(inet_frags_init_net);



void inet_frags_fini(struct inet_frags *f)

{

	cancel_work_sync(&f->frags_work);

net/ipv4/ip_fragment.c

+9 −3
Original line number Diff line number Diff line
@@ -839,6 +839,8 @@ static void __init ip4_frags_ctl_register(void) 


static int __net_init ipv4_frags_init_net(struct net *net)

{

	int res;



	/* Fragment cache limits.

	 *

	 * The fragment memory accounting code, (tries to) account for
@@ -862,9 +864,13 @@ static int __net_init ipv4_frags_init_net(struct net *net) 
	 */

	net->ipv4.frags.timeout = IP_FRAG_TIME;



	inet_frags_init_net(&net->ipv4.frags);



	return ip4_frags_ns_ctl_register(net);

	res = inet_frags_init_net(&net->ipv4.frags);

	if (res)

		return res;

	res = ip4_frags_ns_ctl_register(net);

	if (res)

		inet_frags_uninit_net(&net->ipv4.frags);

	return res;

}



static void __net_exit ipv4_frags_exit_net(struct net *net)

net/ipv6/netfilter/nf_conntrack_reasm.c

+9 −3
Original line number Diff line number Diff line
@@ -648,12 +648,18 @@ EXPORT_SYMBOL_GPL(nf_ct_frag6_consume_orig); 


static int nf_ct_net_init(struct net *net)

{

	int res;



	net->nf_frag.frags.high_thresh = IPV6_FRAG_HIGH_THRESH;

	net->nf_frag.frags.low_thresh = IPV6_FRAG_LOW_THRESH;

	net->nf_frag.frags.timeout = IPV6_FRAG_TIMEOUT;

	inet_frags_init_net(&net->nf_frag.frags);



	return nf_ct_frag6_sysctl_register(net);

	res = inet_frags_init_net(&net->nf_frag.frags);

	if (res)

		return res;

	res = nf_ct_frag6_sysctl_register(net);

	if (res)

		inet_frags_uninit_net(&net->nf_frag.frags);

	return res;

}



static void nf_ct_net_exit(struct net *net)

CRA Git | Maintained and supported by SUSTech CRA and CCSE