netdev - Re: [PATCH] net-sysfs: Fix reference count leak in rx|netdev_queue_add

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ff662def-67dc-8e54-80eb-cfe7a98767ae@gmail.com>
Date:   Wed, 20 Nov 2019 19:12:24 -0800
From:   Eric Dumazet <eric.dumazet@...il.com>
To:     David Miller <davem@...emloft.net>, jouni.hogander@...kie.com
Cc:     netdev@...r.kernel.org, lukas.bulwahn@...il.com
Subject: Re: [PATCH] net-sysfs: Fix reference count leak in
 rx|netdev_queue_add_kobject



On 11/20/19 12:10 PM, David Miller wrote:
> From: jouni.hogander@...kie.com
> Date: Wed, 20 Nov 2019 09:08:16 +0200
> 
>> From: Jouni Hogander <jouni.hogander@...kie.com>
>>
>> kobject_init_and_add takes reference even when it fails. This has
>> to be given up by the caller in error handling. Otherwise memory
>> allocated by kobject_init_and_add is never freed. Originally found
>> by Syzkaller:
>>
>> BUG: memory leak
>  ...
>> Signed-off-by: Jouni Hogander <jouni.hogander@...kie.com>
> 
> Applied, thank you.
> 

I am late to the party, sorry.

But I do not see a Fixes: tag, and the patch seems buggy.

I question how it was really tested ? Please Jouni share your drugs :)

I would rather see this stuff for net-next, because whatever memory leak
we had for years has not raised serious concerns.

I will submit this fix, I guess...

diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 4f404bf33e44c977c1a8ba00706817b76215b75c..ae3bcb1540ec57df311dac6847323a23a74ec960 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -1474,6 +1474,7 @@ static int netdev_queue_add_kobject(struct net_device *dev, int index)
 #endif
 
        kobject_uevent(kobj, KOBJ_ADD);
+       return 0;
 
 err:
        kobject_put(kobj);