netdev - Re: [PATCH net] team: Free BPF filter when unregistering netdev

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 4 Mar 2019 07:53:57 +0100
From:   Jiri Pirko <jiri@...nulli.us>
To:     Ido Schimmel <idosch@...lanox.com>
Cc:     "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "davem@...emloft.net" <davem@...emloft.net>,
        Jiri Pirko <jiri@...lanox.com>, mlxsw <mlxsw@...lanox.com>
Subject: Re: [PATCH net] team: Free BPF filter when unregistering netdev

Sun, Mar 03, 2019 at 08:35:51AM CET, idosch@...lanox.com wrote:
>When team is used in loadbalance mode a BPF filter can be used to
>provide a hash which will determine the Tx port.
>
>When the netdev is later unregistered the filter is not freed which
>results in memory leaks [1].
>
>Fix by freeing the program and the corresponding filter when
>unregistering the netdev.
>
>[1]
>unreferenced object 0xffff8881dbc47cc8 (size 16):
>  comm "teamd", pid 3068, jiffies 4294997779 (age 438.247s)
>  hex dump (first 16 bytes):
>    a3 00 6b 6b 6b 6b 6b 6b 88 a5 82 e1 81 88 ff ff  ..kkkkkk........
>  backtrace:
>    [<000000008a3b47e3>] team_nl_cmd_options_set+0x88f/0x11b0
>    [<00000000c4f4f27e>] genl_family_rcv_msg+0x78f/0x1080
>    [<00000000610ef838>] genl_rcv_msg+0xca/0x170
>    [<00000000a281df93>] netlink_rcv_skb+0x132/0x380
>    [<000000004d9448a2>] genl_rcv+0x29/0x40
>    [<000000000321b2f4>] netlink_unicast+0x4c0/0x690
>    [<000000008c25dffb>] netlink_sendmsg+0x929/0xe10
>    [<00000000068298c5>] sock_sendmsg+0xc8/0x110
>    [<0000000082a61ff0>] ___sys_sendmsg+0x77a/0x8f0
>    [<00000000663ae29d>] __sys_sendmsg+0xf7/0x250
>    [<0000000027c5f11a>] do_syscall_64+0x14d/0x610
>    [<000000006cfbc8d3>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
>    [<00000000e23197e2>] 0xffffffffffffffff
>unreferenced object 0xffff8881e182a588 (size 2048):
>  comm "teamd", pid 3068, jiffies 4294997780 (age 438.247s)
>  hex dump (first 32 bytes):
>    20 00 00 00 02 00 00 00 30 00 00 00 28 f0 ff ff   .......0...(...
>    07 00 00 00 00 00 00 00 28 00 00 00 00 00 00 00  ........(.......
>  backtrace:
>    [<000000002daf01fb>] lb_bpf_func_set+0x45c/0x6d0
>    [<000000008a3b47e3>] team_nl_cmd_options_set+0x88f/0x11b0
>    [<00000000c4f4f27e>] genl_family_rcv_msg+0x78f/0x1080
>    [<00000000610ef838>] genl_rcv_msg+0xca/0x170
>    [<00000000a281df93>] netlink_rcv_skb+0x132/0x380
>    [<000000004d9448a2>] genl_rcv+0x29/0x40
>    [<000000000321b2f4>] netlink_unicast+0x4c0/0x690
>    [<000000008c25dffb>] netlink_sendmsg+0x929/0xe10
>    [<00000000068298c5>] sock_sendmsg+0xc8/0x110
>    [<0000000082a61ff0>] ___sys_sendmsg+0x77a/0x8f0
>    [<00000000663ae29d>] __sys_sendmsg+0xf7/0x250
>    [<0000000027c5f11a>] do_syscall_64+0x14d/0x610
>    [<000000006cfbc8d3>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
>    [<00000000e23197e2>] 0xffffffffffffffff
>
>Fixes: 01d7f30a9f96 ("team: add loadbalance mode")
>Signed-off-by: Ido Schimmel <idosch@...lanox.com>
>Reported-by: Amit Cohen <amitc@...lanox.com>

Acked-by: Jiri Pirko <jiri@...lanox.com>