netdev - Re: [Patch net v2] tun: fix a memory leak for tfile->tx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 11 Jan 2018 18:16:45 +0800
From:   Jason Wang <jasowang@...hat.com>
To:     Cong Wang <xiyou.wangcong@...il.com>, netdev@...r.kernel.org
Cc:     dvyukov@...gle.com, "Michael S. Tsirkin" <mst@...hat.com>
Subject: Re: [Patch net v2] tun: fix a memory leak for tfile->tx_array

On 2018年01月11日 02:51, Cong Wang wrote:
> tfile->tun could be detached before we close the tun fd,
> via tun_detach_all(), so it should not be used to check for
> tfile->tx_array.
>
> As Jason suggested, we probably have to clean it up
> unconditionally, but this requires to check if it is initialized
> or not. Currently skb_array_cleanup() doesn't have such a check,
> so I check it in the caller, it is ugly but we can always
> improve it in net-next.

Rethink about this, looks like I was wrong. The case I mentioned 
previously is

open
attach
detach
close

But during close, we will try to enable tfile through tun_enable_queue() 
in __tun_detach(), which means we can do the cleanup for sure.

It looks to me what is actual missed is the cleanups tun_detach_all(). 
For me the only case that could leak is

open
attach
ip link del link dev tap0
close or another set_iff()

So in this case, clean during close is not sufficient since it could be 
attached to another device.

Thanks

>
> Reported-by: Dmitry Vyukov <dvyukov@...gle.com>
> Fixes: 1576d9860599 ("tun: switch to use skb array for tx")
> Cc: Jason Wang <jasowang@...hat.com>
> Signed-off-by: Cong Wang <xiyou.wangcong@...il.com>
> ---
>   drivers/net/tun.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/tun.c b/drivers/net/tun.c
> index 4f4a842a1c9c..4c85474ffbaf 100644
> --- a/drivers/net/tun.c
> +++ b/drivers/net/tun.c
> @@ -657,7 +657,7 @@ static void __tun_detach(struct tun_file *tfile, bool clean)
>   			    tun->dev->reg_state == NETREG_REGISTERED)
>   				unregister_netdevice(tun->dev);
>   		}
> -		if (tun)
> +		if (tfile->tx_array.ring.queue)
>   			skb_array_cleanup(&tfile->tx_array);
>   		sock_put(&tfile->sk);
>   	}
> @@ -2851,6 +2851,8 @@ static int tun_chr_open(struct inode *inode, struct file * file)
>   
>   	sock_set_flag(&tfile->sk, SOCK_ZEROCOPY);
>   
> +	memset(&tfile->tx_array, 0, sizeof(tfile->tx_array));
> +
>   	return 0;
>   }
>