| Message ID | 20230409022048.61223-1-chenaotian2@163.com (mailing list archive) |
|---|---|
| State | Accepted |
| Headers | show |
| Series | [PATH,wpan,v3] ieee802154: hwsim: Fix possible memory leaks | expand |
Hello. On 09.04.23 04:20, Chen Aotian wrote: > After replacing e->info, it is necessary to free the old einfo. > > Fixes: f25da51fdc38 ("ieee802154: hwsim: add replacement for fakelb") > Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com> > Reviewed-by: Alexander Aring <aahringo@redhat.com> > Signed-off-by: Chen Aotian <chenaotian2@163.com> > --- > > V2 -> V3: > * lock_is_held() => lockdep_is_held().(thanks for Alexander) > > V1 -> V2: > * Using rcu_replace_pointer() is better then rcu_dereference() > and rcu_assign_pointer(). > > drivers/net/ieee802154/mac802154_hwsim.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/drivers/net/ieee802154/mac802154_hwsim.c b/drivers/net/ieee802154/mac802154_hwsim.c > index 8445c2189..31cba9aa7 100644 > --- a/drivers/net/ieee802154/mac802154_hwsim.c > +++ b/drivers/net/ieee802154/mac802154_hwsim.c > @@ -685,7 +685,7 @@ static int hwsim_del_edge_nl(struct sk_buff *msg, struct genl_info *info) > static int hwsim_set_edge_lqi(struct sk_buff *msg, struct genl_info *info) > { > struct nlattr *edge_attrs[MAC802154_HWSIM_EDGE_ATTR_MAX + 1]; > - struct hwsim_edge_info *einfo; > + struct hwsim_edge_info *einfo, *einfo_old; > struct hwsim_phy *phy_v0; > struct hwsim_edge *e; > u32 v0, v1; > @@ -723,8 +723,10 @@ static int hwsim_set_edge_lqi(struct sk_buff *msg, struct genl_info *info) > list_for_each_entry_rcu(e, &phy_v0->edges, list) { > if (e->endpoint->idx == v1) { > einfo->lqi = lqi; > - rcu_assign_pointer(e->info, einfo); > + einfo_old = rcu_replace_pointer(e->info, einfo, > + lockdep_is_held(&hwsim_phys_lock)); > rcu_read_unlock(); > + kfree_rcu(einfo_old, rcu); > mutex_unlock(&hwsim_phys_lock); > return 0; > } This patch has been applied to the wpan tree and will be part of the next pull request to net. Thanks! regards Stefan Schmidt
diff --git a/drivers/net/ieee802154/mac802154_hwsim.c b/drivers/net/ieee802154/mac802154_hwsim.c index 8445c2189..31cba9aa7 100644 --- a/drivers/net/ieee802154/mac802154_hwsim.c +++ b/drivers/net/ieee802154/mac802154_hwsim.c @@ -685,7 +685,7 @@ static int hwsim_del_edge_nl(struct sk_buff *msg, struct genl_info *info) static int hwsim_set_edge_lqi(struct sk_buff *msg, struct genl_info *info) { struct nlattr *edge_attrs[MAC802154_HWSIM_EDGE_ATTR_MAX + 1]; - struct hwsim_edge_info *einfo; + struct hwsim_edge_info *einfo, *einfo_old; struct hwsim_phy *phy_v0; struct hwsim_edge *e; u32 v0, v1; @@ -723,8 +723,10 @@ static int hwsim_set_edge_lqi(struct sk_buff *msg, struct genl_info *info) list_for_each_entry_rcu(e, &phy_v0->edges, list) { if (e->endpoint->idx == v1) { einfo->lqi = lqi; - rcu_assign_pointer(e->info, einfo); + einfo_old = rcu_replace_pointer(e->info, einfo, + lockdep_is_held(&hwsim_phys_lock)); rcu_read_unlock(); + kfree_rcu(einfo_old, rcu); mutex_unlock(&hwsim_phys_lock); return 0; }
After replacing e->info, it is necessary to free the old einfo. Fixes: f25da51fdc38 ("ieee802154: hwsim: add replacement for fakelb") Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com> Reviewed-by: Alexander Aring <aahringo@redhat.com> Signed-off-by: Chen Aotian <chenaotian2@163.com> --- V2 -> V3: * lock_is_held() => lockdep_is_held().(thanks for Alexander) V1 -> V2: * Using rcu_replace_pointer() is better then rcu_dereference() and rcu_assign_pointer(). drivers/net/ieee802154/mac802154_hwsim.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)