kernel/linux.git/net/802/garp.c, branch v4.9.331

net/802/garp: fix memleak in garp_request_join()

2021-08-04T09:58:02+00:00

[ Upstream commit 42ca63f980842918560b25f0244307fd83b4777c ] I got kmemleak report when doing fuzz test: BUG: memory leak unreferenced object 0xffff88810c909b80 (size 64): comm "syz", pid 957, jiffies 4295220394 (age 399.090s) hex dump (first 32 bytes): 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 08 00 00 00 01 02 00 04 ................ backtrace: [<00000000ca1f2e2e>] garp_request_join+0x285/0x3d0 [<00000000bf153351>] vlan_gvrp_request_join+0x15b/0x190 [<0000000024005e72>] vlan_dev_open+0x706/0x980 [<00000000dc20c4d4>] __dev_open+0x2bb/0x460 [<0000000066573004>] __dev_change_flags+0x501/0x650 [<0000000035b42f83>] rtnl_configure_link+0xee/0x280 [<00000000a5e69de0>] __rtnl_newlink+0xed5/0x1550 [<00000000a5258f4a>] rtnl_newlink+0x66/0x90 [<00000000506568ee>] rtnetlink_rcv_msg+0x439/0xbd0 [<00000000b7eaeae1>] netlink_rcv_skb+0x14d/0x420 [<00000000c373ce66>] netlink_unicast+0x550/0x750 [<00000000ec74ce74>] netlink_sendmsg+0x88b/0xda0 [<00000000381ff246>] sock_sendmsg+0xc9/0x120 [<000000008f6a2db3>] ____sys_sendmsg+0x6e8/0x820 [<000000008d9c1735>] ___sys_sendmsg+0x145/0x1c0 [<00000000aa39dd8b>] __sys_sendmsg+0xfe/0x1d0 Calling garp_request_leave() after garp_request_join(), the attr->state is set to GARP_APPLICANT_VO, garp_attr_destroy() won't be called in last transmit event in garp_uninit_applicant(), the attr of applicant will be leaked. To fix this leak, iterate and free each attr of applicant before rerturning from garp_uninit_applicant(). Reported-by: Hulk Robot Signed-off-by: Yang Yingliang Signed-off-by: David S. Miller Signed-off-by: Sasha Levin

net: replace macros net_random and net_srandom with direct calls to prandom

2014-01-14T23:15:25+00:00

This patch removes the net_random and net_srandom macros and replaces them with direct calls to the prandom ones. As new commits only seem to use prandom_u32 there is no use to keep them around. This change makes it easier to grep for users of prandom_u32. Signed-off-by: Aruna-Hewapathirane Suggested-by: Hannes Frederic Sowa Acked-by: Hannes Frederic Sowa Signed-off-by: David S. Miller

802: fix a possible race condition

2013-04-07T21:04:17+00:00

(Resend with a better changelog) garp_pdu_queue() should ways be called with this spin lock. garp_uninit_applicant() only holds rtnl lock which is not enough here. A possible race can happen as garp_pdu_rcv() is called in BH context: garp_pdu_rcv() |->garp_pdu_parse_msg() |->garp_pdu_parse_attr() |-> garp_gid_event() Found by code inspection. Cc: Eric Dumazet Cc: "David S. Miller" Cc: David Ward Cc: "Jorge Boncompte [DTI2]" Signed-off-by: Cong Wang Signed-off-by: David S. Miller

net/garp: fix GID rbtree ordering

2012-04-13T17:10:33+00:00

The comparison operators were backwards in both garp_attr_lookup and garp_attr_create, so the entire GID rbtree was in reverse order. (There was no practical side effect to this though, except that PDUs were sent with attributes listed in reverse order, which is still valid by the protocol. This change is only for clarity.) Signed-off-by: David Ward Signed-off-by: David S. Miller

net/garp: avoid infinite loop if attribute already exists

2012-04-01T20:47:11+00:00

An infinite loop occurred if garp_attr_create was called with the values of an existing attribute. This might happen if a previous leave request for the attribute has not yet been followed by a PDU transmission (or, if the application previously issued a join request for the attribute and is now issuing another one, without having issued a leave request). If garp_attr_create finds an existing attribute having the same values, return the address to it. Its state will then get updated (i.e., if it was in a leaving state, it will move into a non-leaving state and not get deleted during the next PDU transmission). To accomplish this fix, collapse garp_attr_insert into garp_attr_create (which is its only caller). Thanks to Jorge Boncompte [DTI2] for contributing to this fix. Signed-off-by: David Ward Acked-by: Jorge Boncompte [DTI2] Signed-off-by: David S. Miller

net: Fix files explicitly needing to include module.h

2011-10-31T23:30:28+00:00

With calls to modular infrastructure, these files really needs the full module.h header. Call it out so some of the cleanups of implicit and unrequired includes elsewhere can be cleaned up. Signed-off-by: Paul Gortmaker

rcu: convert uses of rcu_assign_pointer(x, NULL) to RCU_INIT_POINTER

2011-08-02T11:29:23+00:00

When assigning a NULL value to an RCU protected pointer, no barrier is needed. The rcu_assign_pointer, used to handle that but will soon change to not handle the special case. Convert all rcu_assign_pointer of NULL value. //smpl @@ expression P; @@ - rcu_assign_pointer(P, NULL) + RCU_INIT_POINTER(P, NULL) // Signed-off-by: Stephen Hemminger Acked-by: Paul E. McKenney Signed-off-by: David S. Miller

garp: use kfree_rcu()

2011-05-21T06:05:22+00:00

Use kfree_rcu() instead of call_rcu(), remove garp_cleanup_module() Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller

garp: remove last synchronize_rcu() call

2011-05-12T21:46:56+00:00

When removing last vlan from a device, garp_uninit_applicant() calls synchronize_rcu() to make sure no user can still manipulate struct garp_applicant before we free it. Use call_rcu() instead, as a step to further net_device dismantle optimizations. Add the temporary garp_cleanup_module() function to make sure no pending call_rcu() are left at module unload time [ this will be removed when kfree_rcu() is available ] Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller

garp: remove one synchronize_rcu() call

2011-05-09T18:41:40+00:00

Speedup vlan dismantling in CONFIG_VLAN_8021Q_GVRP=y cases, by using a call_rcu() to free the memory instead of waiting with expensive synchronize_rcu() [ while RTNL is held ] Signed-off-by: Eric Dumazet Cc: Ben Greear Cc: Patrick McHardy Cc: Paul E. McKenney Signed-off-by: David S. Miller