netdev - Re: [PATCH net v2 1/2] mlx4: Fix memory leak after mlx4_en_update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 2 Feb 2017 19:10:29 +0200
From:   Tariq Toukan <tariqt@...lanox.com>
To:     Martin KaFai Lau <kafai@...com>, <netdev@...r.kernel.org>
CC:     Saeed Mahameed <saeedm@...lanox.com>,
        Tariq Toukan <tariqt@...lanox.com>,
        Kernel Team <kernel-team@...com>,
        Eugenia Emantayev <eugenia@...lanox.com>
Subject: Re: [PATCH net v2 1/2] mlx4: Fix memory leak after
 mlx4_en_update_priv()

Hi Martin,

Thanks for your fix!

On 01/02/2017 8:35 AM, Martin KaFai Lau wrote:
> In mlx4_en_update_priv(), dst->tx_ring[t] and dst->tx_cq[t]
> are over-written by src->tx_ring[t] and src->tx_cq[t] without
> first calling kfree.
>
> One of the reproducible code paths is by doing 'ethtool -L'.
>
> The fix is to do the kfree in mlx4_en_free_resources().
>
...
> Fixes: ec25bc04ed8e ("net/mlx4_en: Add resilience in low memory systems")
> Cc: Eugenia Emantayev <eugenia@...lanox.com>
> Cc: Saeed Mahameed <saeedm@...lanox.com>
> Cc: Tariq Toukan <tariqt@...lanox.com>
> Signed-off-by: Martin KaFai Lau <kafai@...com>
> ---
>   drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 8 ++------
>   1 file changed, 2 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
> index 761f8b12399c..3abcead208d2 100644
> --- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
> +++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
> @@ -2042,6 +2042,8 @@ static void mlx4_en_free_resources(struct mlx4_en_priv *priv)
>   			if (priv->tx_cq[t] && priv->tx_cq[t][i])
>   				mlx4_en_destroy_cq(priv, &priv->tx_cq[t][i]);
>   		}
> +		kfree(priv->tx_ring[t]);
> +		kfree(priv->tx_cq[t]);
>   	}
>   
>   	for (i = 0; i < priv->rx_ring_num; i++) {
> @@ -2214,7 +2216,6 @@ void mlx4_en_destroy_netdev(struct net_device *dev)
>   {
>   	struct mlx4_en_priv *priv = netdev_priv(dev);
>   	struct mlx4_en_dev *mdev = priv->mdev;
> -	int t;
>   
>   	en_dbg(DRV, priv, "Destroying netdev on port:%d\n", priv->port);
>   
> @@ -2248,11 +2249,6 @@ void mlx4_en_destroy_netdev(struct net_device *dev)
>   	mlx4_en_free_resources(priv);
>   	mutex_unlock(&mdev->state_lock);
>   
> -	for (t = 0; t < MLX4_EN_NUM_TX_TYPES; t++) {
> -		kfree(priv->tx_ring[t]);
> -		kfree(priv->tx_cq[t]);
> -	}
> -
>   	free_netdev(dev);
>   }
>   
Reviewed-by: Tariq Toukan <tariqt@...lanox.com>