netdev - [PATCH] net: fix two possible memory leaks in netif_set_xps

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 26 Mar 2015 15:40:43 +0800
From:	roy.qing.li@...il.com
To:	netdev@...r.kernel.org, alexander.h.duyck@...hat.com
Subject: [PATCH] net: fix two possible memory leaks in netif_set_xps_queue

From: Li RongQing <roy.qing.li@...il.com>

new_dev_maps->cpu_map[cpu] maybe be assigned to the memory from
expand_xps_map() in the first loop, so should be freed

when free dev_maps, make sure to free new_dev_maps->cpu_map[cpu]
firstly

Fixes: 537c00de1c [net: Add functions netif_reset_xps_queue and netif_set_xps_queue]
Cc: Alexander Duyck <alexander.h.duyck@...hat.com>
Signed-off-by: Li RongQing <roy.qing.li@...il.com>
---
 net/core/dev.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/net/core/dev.c b/net/core/dev.c
index 5d43e01..aa6459f 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2025,9 +2025,11 @@ int netif_set_xps_queue(struct net_device *dev, const struct cpumask *mask,
 		} else if (dev_maps) {
 			/* fill in the new device map from the old device map */
 			map = xmap_dereference(dev_maps->cpu_map[cpu]);
+			new_map = xmap_dereference(new_dev_maps->cpu_map[cpu]);
 			RCU_INIT_POINTER(new_dev_maps->cpu_map[cpu], map);
+			if (new_map && map != new_map)
+				kfree_rcu(new_map, rcu);
 		}
-
 	}
 
 	rcu_assign_pointer(dev->xps_maps, new_dev_maps);
@@ -2068,6 +2070,13 @@ out_no_new_maps:
 	/* free map if not active */
 	if (!active) {
 		RCU_INIT_POINTER(dev->xps_maps, NULL);
+
+		for_each_possible_cpu(cpu) {
+			map = xmap_dereference(dev_maps->cpu_map[cpu]);
+			if (map)
+				kfree_rcu(map, rcu);
+		}
+
 		kfree_rcu(dev_maps, rcu);
 	}
 
-- 
2.1.0

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html