| Message ID | 20231220030838.11751-1-hbh25y@gmail.com (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | net: sched: em_text: fix possible memory leak in em_text_destroy() | expand |
Hi Hangyu, While the fix looks correct - can you please describe how you came across this issue? Was it a tool or by inspection? Do you have a text case that triggered something etc, etc. On Tue, Dec 19, 2023 at 10:09 PM Hangyu Hua <hbh25y@gmail.com> wrote: > > m->data needs to be freed when em_text_destroy is called. > > Fixes: d675c989ed2d ("[PKT_SCHED]: Packet classification based on textsearch (ematch)") > Signed-off-by: Hangyu Hua <hbh25y@gmail.com> > --- > net/sched/em_text.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/net/sched/em_text.c b/net/sched/em_text.c > index 6f3c1fb2fb44..b9d5d4dca2c9 100644 > --- a/net/sched/em_text.c > +++ b/net/sched/em_text.c > @@ -97,8 +97,10 @@ static int em_text_change(struct net *net, void *data, int len, > > static void em_text_destroy(struct tcf_ematch *m) > { > - if (EM_TEXT_PRIV(m) && EM_TEXT_PRIV(m)->config) > + if (EM_TEXT_PRIV(m) && EM_TEXT_PRIV(m)->config) { > textsearch_destroy(EM_TEXT_PRIV(m)->config); > + kfree(m->data); > + } > } > Acked-by: Jamal Hadi Salim <jhs@mojatatu.com> cheers, jamal > static int em_text_dump(struct sk_buff *skb, struct tcf_ematch *m) > -- > 2.34.1 >
Hi Hangyu, kernel test robot noticed the following build warnings: [auto build test WARNING on net-next/main] [also build test WARNING on net/main linus/master v6.7-rc6] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in https://git-scm.com/docs/git-format-patch#_base_tree_information] url: https://github.com/intel-lab-lkp/linux/commits/Hangyu-Hua/net-sched-em_text-fix-possible-memory-leak-in-em_text_destroy/20231220-111317 base: net-next/main patch link: https://lore.kernel.org/r/20231220030838.11751-1-hbh25y%40gmail.com patch subject: [PATCH] net: sched: em_text: fix possible memory leak in em_text_destroy() config: m68k-allmodconfig (https://download.01.org/0day-ci/archive/20231220/202312202228.58nFn5h0-lkp@intel.com/config) compiler: m68k-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20231220/202312202228.58nFn5h0-lkp@intel.com/reproduce) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp@intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202312202228.58nFn5h0-lkp@intel.com/ All warnings (new ones prefixed by >>): net/sched/em_text.c: In function 'em_text_destroy': >> net/sched/em_text.c:102:24: warning: passing argument 1 of 'kfree' makes pointer from integer without a cast [-Wint-conversion] 102 | kfree(m->data); | ~^~~~~~ | | | long unsigned int In file included from net/sched/em_text.c:8: include/linux/slab.h:227:24: note: expected 'const void *' but argument is of type 'long unsigned int' 227 | void kfree(const void *objp); | ~~~~~~~~~~~~^~~~ vim +/kfree +102 net/sched/em_text.c 97 98 static void em_text_destroy(struct tcf_ematch *m) 99 { 100 if (EM_TEXT_PRIV(m) && EM_TEXT_PRIV(m)->config) { 101 textsearch_destroy(EM_TEXT_PRIV(m)->config); > 102 kfree(m->data); 103 } 104 } 105
On Wed, Dec 20, 2023 at 6:55 AM Jamal Hadi Salim <jhs@mojatatu.com> wrote: > > Hi Hangyu, > While the fix looks correct - can you please describe how you came > across this issue? Was it a tool or by inspection? Do you have a text > case that triggered something etc, etc. > > On Tue, Dec 19, 2023 at 10:09 PM Hangyu Hua <hbh25y@gmail.com> wrote: > > > > m->data needs to be freed when em_text_destroy is called. > > > > Fixes: d675c989ed2d ("[PKT_SCHED]: Packet classification based on textsearch (ematch)") > > Signed-off-by: Hangyu Hua <hbh25y@gmail.com> > > --- > > net/sched/em_text.c | 4 +++- > > 1 file changed, 3 insertions(+), 1 deletion(-) > > > > diff --git a/net/sched/em_text.c b/net/sched/em_text.c > > index 6f3c1fb2fb44..b9d5d4dca2c9 100644 > > --- a/net/sched/em_text.c > > +++ b/net/sched/em_text.c > > @@ -97,8 +97,10 @@ static int em_text_change(struct net *net, void *data, int len, > > > > static void em_text_destroy(struct tcf_ematch *m) > > { > > - if (EM_TEXT_PRIV(m) && EM_TEXT_PRIV(m)->config) > > + if (EM_TEXT_PRIV(m) && EM_TEXT_PRIV(m)->config) { > > textsearch_destroy(EM_TEXT_PRIV(m)->config); > > + kfree(m->data); > > + } > > } > > > the bot just complained about needing a cast, use this: struct text_match * cheers, jamal > Acked-by: Jamal Hadi Salim <jhs@mojatatu.com> > > cheers, > jamal > > > static int em_text_dump(struct sk_buff *skb, struct tcf_ematch *m) > > -- > > 2.34.1 > >
Hi Hangyu, kernel test robot noticed the following build errors: [auto build test ERROR on net-next/main] [also build test ERROR on net/main linus/master v6.7-rc6 next-20231220] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in https://git-scm.com/docs/git-format-patch#_base_tree_information] url: https://github.com/intel-lab-lkp/linux/commits/Hangyu-Hua/net-sched-em_text-fix-possible-memory-leak-in-em_text_destroy/20231220-111317 base: net-next/main patch link: https://lore.kernel.org/r/20231220030838.11751-1-hbh25y%40gmail.com patch subject: [PATCH] net: sched: em_text: fix possible memory leak in em_text_destroy() config: x86_64-rhel-8.3-rust (https://download.01.org/0day-ci/archive/20231221/202312210705.j1LTJmpH-lkp@intel.com/config) compiler: clang version 16.0.4 (https://github.com/llvm/llvm-project.git ae42196bc493ffe877a7e3dff8be32035dea4d07) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20231221/202312210705.j1LTJmpH-lkp@intel.com/reproduce) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp@intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202312210705.j1LTJmpH-lkp@intel.com/ All errors (new ones prefixed by >>): >> net/sched/em_text.c:102:9: error: incompatible integer to pointer conversion passing 'unsigned long' to parameter of type 'const void *' [-Wint-conversion] kfree(m->data); ^~~~~~~ include/linux/slab.h:227:24: note: passing argument to parameter 'objp' here void kfree(const void *objp); ^ 1 error generated. vim +102 net/sched/em_text.c 97 98 static void em_text_destroy(struct tcf_ematch *m) 99 { 100 if (EM_TEXT_PRIV(m) && EM_TEXT_PRIV(m)->config) { 101 textsearch_destroy(EM_TEXT_PRIV(m)->config); > 102 kfree(m->data); 103 } 104 } 105
On 21/12/2023 00:05, Jamal Hadi Salim wrote: > On Wed, Dec 20, 2023 at 6:55 AM Jamal Hadi Salim <jhs@mojatatu.com> wrote: >> >> Hi Hangyu, >> While the fix looks correct - can you please describe how you came >> across this issue? Was it a tool or by inspection? Do you have a text >> case that triggered something etc, etc. I discovered this accidentally when I used gdb to debug a program that uses em_text. And I think putting the code in the commit log will will make it too bulky. >> >> On Tue, Dec 19, 2023 at 10:09 PM Hangyu Hua <hbh25y@gmail.com> wrote: >>> >>> m->data needs to be freed when em_text_destroy is called. >>> >>> Fixes: d675c989ed2d ("[PKT_SCHED]: Packet classification based on textsearch (ematch)") >>> Signed-off-by: Hangyu Hua <hbh25y@gmail.com> >>> --- >>> net/sched/em_text.c | 4 +++- >>> 1 file changed, 3 insertions(+), 1 deletion(-) >>> >>> diff --git a/net/sched/em_text.c b/net/sched/em_text.c >>> index 6f3c1fb2fb44..b9d5d4dca2c9 100644 >>> --- a/net/sched/em_text.c >>> +++ b/net/sched/em_text.c >>> @@ -97,8 +97,10 @@ static int em_text_change(struct net *net, void *data, int len, >>> >>> static void em_text_destroy(struct tcf_ematch *m) >>> { >>> - if (EM_TEXT_PRIV(m) && EM_TEXT_PRIV(m)->config) >>> + if (EM_TEXT_PRIV(m) && EM_TEXT_PRIV(m)->config) { >>> textsearch_destroy(EM_TEXT_PRIV(m)->config); >>> + kfree(m->data); >>> + } >>> } >>> >> > > the bot just complained about needing a cast, use this: > struct text_match * I see. I will send a v2 later. Thanks, Hangyu > > cheers, > jamal >> Acked-by: Jamal Hadi Salim <jhs@mojatatu.com> >> >> cheers, >> jamal >> >>> static int em_text_dump(struct sk_buff *skb, struct tcf_ematch *m) >>> -- >>> 2.34.1 >>>
diff --git a/net/sched/em_text.c b/net/sched/em_text.c index 6f3c1fb2fb44..b9d5d4dca2c9 100644 --- a/net/sched/em_text.c +++ b/net/sched/em_text.c @@ -97,8 +97,10 @@ static int em_text_change(struct net *net, void *data, int len, static void em_text_destroy(struct tcf_ematch *m) { - if (EM_TEXT_PRIV(m) && EM_TEXT_PRIV(m)->config) + if (EM_TEXT_PRIV(m) && EM_TEXT_PRIV(m)->config) { textsearch_destroy(EM_TEXT_PRIV(m)->config); + kfree(m->data); + } } static int em_text_dump(struct sk_buff *skb, struct tcf_ematch *m)
m->data needs to be freed when em_text_destroy is called. Fixes: d675c989ed2d ("[PKT_SCHED]: Packet classification based on textsearch (ematch)") Signed-off-by: Hangyu Hua <hbh25y@gmail.com> --- net/sched/em_text.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)