diff mbox series

ieee802154: hwsim: Fix memory leak in hwsim_add_one

Message ID 20210615112454.2497316-1-mudongliangabcd@gmail.com (mailing list archive)
State Superseded
Headers show
Series ieee802154: hwsim: Fix memory leak in hwsim_add_one | expand

Commit Message

Dongliang Mu June 15, 2021, 11:24 a.m. UTC
No matter from hwsim_remove or hwsim_del_radio_nl, hwsim_del fails to
remove the entry in the edges list. Take the example below, phy0, phy1
and e0 will be deleted, resulting in e1 not freed and accessed in the

    |                            |
phy0 (edges)                 phy1 (edges)
   ----> e1 (idx = 1)             ----> e0 (idx = 0)

Fix this by deleting and freeing all the entries in the edges list
between hwsim_edge_unsubscribe_me and list_del(&phy->list).

Reported-by: syzbot+b80c9959009a9325cdff@syzkaller.appspotmail.com
Fixes: 1c9f4a3fce77 ("ieee802154: hwsim: fix rcu handling")
Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
 drivers/net/ieee802154/mac802154_hwsim.c | 7 +++++++
 1 file changed, 7 insertions(+)
diff mbox series


diff --git a/drivers/net/ieee802154/mac802154_hwsim.c b/drivers/net/ieee802154/mac802154_hwsim.c
index da9135231c07..b05159cff33a 100644
--- a/drivers/net/ieee802154/mac802154_hwsim.c
+++ b/drivers/net/ieee802154/mac802154_hwsim.c
@@ -824,9 +824,16 @@  static int hwsim_add_one(struct genl_info *info, struct device *dev,
 static void hwsim_del(struct hwsim_phy *phy)
 	struct hwsim_pib *pib;
+	struct hwsim_edge *e;
+	// remove the edges in the list
+	list_for_each_entry_rcu(e, &phy->edges, list) {
+		list_del_rcu(&e->list);
+		hwsim_free_edge(e);
+	}