From patchwork Tue Dec 1 09:29:02 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yang Yingliang X-Patchwork-Id: 335640 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.7 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id EB2DEC64E7A for ; Tue, 1 Dec 2020 09:32:24 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 9F02C2080A for ; Tue, 1 Dec 2020 09:32:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729092AbgLAJcN (ORCPT ); Tue, 1 Dec 2020 04:32:13 -0500 Received: from szxga04-in.huawei.com ([45.249.212.190]:8226 "EHLO szxga04-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727744AbgLAJcM (ORCPT ); Tue, 1 Dec 2020 04:32:12 -0500 Received: from DGGEMS408-HUB.china.huawei.com (unknown [172.30.72.58]) by szxga04-in.huawei.com (SkyGuard) with ESMTP id 4ClcKK1VJczkjNd; Tue, 1 Dec 2020 17:30:45 +0800 (CST) Received: from huawei.com (10.175.103.91) by DGGEMS408-HUB.china.huawei.com (10.3.19.208) with Microsoft SMTP Server id 14.3.487.0; Tue, 1 Dec 2020 17:31:10 +0800 From: Yang Yingliang To: CC: , , , , , Subject: [PATCH net v2 1/2] wireguard: device: don't call free_netdev() in priv_destructor() Date: Tue, 1 Dec 2020 17:29:02 +0800 Message-ID: <20201201092903.3269202-1-yangyingliang@huawei.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 X-Originating-IP: [10.175.103.91] X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org After commit cf124db566e6 ("net: Fix inconsistent teardown and..."), priv_destruct() doesn't call free_netdev() in driver, we use dev->needs_free_netdev to indicate whether free_netdev() should be called on release path. This patch remove free_netdev() from priv_destructor() and set dev->needs_free_netdev to true. Signed-off-by: Yang Yingliang --- drivers/net/wireguard/device.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireguard/device.c b/drivers/net/wireguard/device.c index c9f65e96ccb0..578ac6097d7e 100644 --- a/drivers/net/wireguard/device.c +++ b/drivers/net/wireguard/device.c @@ -247,7 +247,6 @@ static void wg_destruct(struct net_device *dev) mutex_unlock(&wg->device_update_lock); pr_debug("%s: Interface destroyed\n", dev->name); - free_netdev(dev); } static const struct device_type device_type = { .name = KBUILD_MODNAME }; @@ -360,6 +359,7 @@ static int wg_newlink(struct net *src_net, struct net_device *dev, * register_netdevice doesn't call it for us if it fails. */ dev->priv_destructor = wg_destruct; + dev->needs_free_netdev = true; pr_debug("%s: Interface created\n", dev->name); return ret; From patchwork Tue Dec 1 09:29:03 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yang Yingliang X-Patchwork-Id: 336672 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.7 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C6878C64E7B for ; Tue, 1 Dec 2020 09:32:24 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 7394620809 for ; Tue, 1 Dec 2020 09:32:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729031AbgLAJcI (ORCPT ); Tue, 1 Dec 2020 04:32:08 -0500 Received: from szxga04-in.huawei.com ([45.249.212.190]:8227 "EHLO szxga04-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727729AbgLAJcH (ORCPT ); Tue, 1 Dec 2020 04:32:07 -0500 Received: from DGGEMS408-HUB.china.huawei.com (unknown [172.30.72.58]) by szxga04-in.huawei.com (SkyGuard) with ESMTP id 4ClcKK1JBtzkjMb; Tue, 1 Dec 2020 17:30:45 +0800 (CST) Received: from huawei.com (10.175.103.91) by DGGEMS408-HUB.china.huawei.com (10.3.19.208) with Microsoft SMTP Server id 14.3.487.0; Tue, 1 Dec 2020 17:31:11 +0800 From: Yang Yingliang To: CC: , , , , , Subject: [PATCH net v2 2/2] net: fix memory leak in register_netdevice() on error path Date: Tue, 1 Dec 2020 17:29:03 +0800 Message-ID: <20201201092903.3269202-2-yangyingliang@huawei.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20201201092903.3269202-1-yangyingliang@huawei.com> References: <20201201092903.3269202-1-yangyingliang@huawei.com> MIME-Version: 1.0 X-Originating-IP: [10.175.103.91] X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org I got a memleak report when doing fault-inject test: unreferenced object 0xffff88810ace9000 (size 1024): comm "ip", pid 4622, jiffies 4295457037 (age 43.378s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000008abe41>] __kmalloc+0x10f/0x210 [<000000005d3533a6>] veth_dev_init+0x140/0x310 [<0000000088353c64>] register_netdevice+0x496/0x7a0 [<000000001324d322>] veth_newlink+0x40b/0x960 [<00000000d0799866>] __rtnl_newlink+0xd8c/0x1360 [<00000000d616040a>] rtnl_newlink+0x6b/0xa0 [<00000000e0a1600d>] rtnetlink_rcv_msg+0x3cc/0x9e0 [<000000009eeff98b>] netlink_rcv_skb+0x130/0x3a0 [<00000000500f8be1>] netlink_unicast+0x4da/0x700 [<00000000666c03b3>] netlink_sendmsg+0x7fe/0xcb0 [<0000000073b28103>] sock_sendmsg+0x143/0x180 [<00000000ad746a30>] ____sys_sendmsg+0x677/0x810 [<0000000087dd98e5>] ___sys_sendmsg+0x105/0x180 [<00000000028dd365>] __sys_sendmsg+0xf0/0x1c0 [<00000000a6bfbae6>] do_syscall_64+0x33/0x40 [<00000000e00521b4>] entry_SYSCALL_64_after_hwframe+0x44/0xa9 It seems ifb and loopback may also hit the leak, so I try to fix this in register_netdevice(). In common case, priv_destructor() will be called in netdev_run_todo() after calling ndo_uninit() in rollback_registered(), on other error path in register_netdevice(), ndo_uninit() and priv_destructor() are called before register_netdevice() return, but in this case, priv_destructor() will never be called, then it causes memory leak, so we should call priv_destructor() here. Reported-by: Hulk Robot Signed-off-by: Yang Yingliang --- net/core/dev.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/net/core/dev.c b/net/core/dev.c index 82dc6b48e45f..51b9cf1ff6a1 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -10003,6 +10003,16 @@ int register_netdevice(struct net_device *dev) rcu_barrier(); dev->reg_state = NETREG_UNREGISTERED; + /* In common case, priv_destructor() will be + * called in netdev_run_todo() after calling + * ndo_uninit() in rollback_registered(). + * But in this case, priv_destructor() will + * never be called, then it causes memory + * leak, so we should call priv_destructor() + * here. + */ + if (dev->priv_destructor) + dev->priv_destructor(dev); /* We should put the kobject that hold in * netdev_unregister_kobject(), otherwise * the net device cannot be freed when