| Message ID | 20230803193834.23340-1-pchelkin@ispras.ru (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | drivers: vxlan: vnifilter: free percpu vni stats on error path | expand |
Prefix should be "PATCH net". See: https://www.kernel.org/doc/html/latest/process/maintainer-netdev.html On Thu, Aug 03, 2023 at 10:38:32PM +0300, Fedor Pchelkin wrote: > In case rhashtable_lookup_insert_fast() fails inside vxlan_vni_add(), the > allocated percpu vni stats are not freed on the error path. > > Free them on the rhashtable_lookup_insert_fast() error path in > vxlan_vni_add(). > > Found by Linux Verification Center (linuxtesting.org). > > Fixes: 4095e0e1328a ("drivers: vxlan: vnifilter: per vni stats") > Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru> > --- > drivers/net/vxlan/vxlan_vnifilter.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/net/vxlan/vxlan_vnifilter.c b/drivers/net/vxlan/vxlan_vnifilter.c > index a3de081cda5e..321cd0b450cc 100644 > --- a/drivers/net/vxlan/vxlan_vnifilter.c > +++ b/drivers/net/vxlan/vxlan_vnifilter.c > @@ -740,6 +740,7 @@ static int vxlan_vni_add(struct vxlan_dev *vxlan, > &vninode->vnode, > vxlan_vni_rht_params); > if (err) { > + free_percpu(vninode->stats); This oversight (and future ones) wouldn't have happened if vxlan_vni_alloc() had a corresponding vxlan_vni_free(). I suggest something like [1]. BTW, I think the GFP_ATOMIC in vxlan_vni_alloc() should be GFP_KERNEL. I will take care of it in net-next. > kfree(vninode); > return err; > } > -- > 2.41.0 [1] diff --git a/drivers/net/vxlan/vxlan_vnifilter.c b/drivers/net/vxlan/vxlan_vnifilter.c index a3de081cda5e..c3ff30ab782e 100644 --- a/drivers/net/vxlan/vxlan_vnifilter.c +++ b/drivers/net/vxlan/vxlan_vnifilter.c @@ -713,6 +713,12 @@ static struct vxlan_vni_node *vxlan_vni_alloc(struct vxlan_dev *vxlan, return vninode; } +static void vxlan_vni_free(struct vxlan_vni_node *vninode) +{ + free_percpu(vninode->stats); + kfree(vninode); +} + static int vxlan_vni_add(struct vxlan_dev *vxlan, struct vxlan_vni_group *vg, u32 vni, union vxlan_addr *group, @@ -740,7 +746,7 @@ static int vxlan_vni_add(struct vxlan_dev *vxlan, &vninode->vnode, vxlan_vni_rht_params); if (err) { - kfree(vninode); + vxlan_vni_free(vninode); return err; } @@ -763,8 +769,7 @@ static void vxlan_vni_node_rcu_free(struct rcu_head *rcu) struct vxlan_vni_node *v; v = container_of(rcu, struct vxlan_vni_node, rcu); - free_percpu(v->stats); - kfree(v); + vxlan_vni_free(v); } static int vxlan_vni_del(struct vxlan_dev *vxlan,
diff --git a/drivers/net/vxlan/vxlan_vnifilter.c b/drivers/net/vxlan/vxlan_vnifilter.c index a3de081cda5e..321cd0b450cc 100644 --- a/drivers/net/vxlan/vxlan_vnifilter.c +++ b/drivers/net/vxlan/vxlan_vnifilter.c @@ -740,6 +740,7 @@ static int vxlan_vni_add(struct vxlan_dev *vxlan, &vninode->vnode, vxlan_vni_rht_params); if (err) { + free_percpu(vninode->stats); kfree(vninode); return err; }
In case rhashtable_lookup_insert_fast() fails inside vxlan_vni_add(), the allocated percpu vni stats are not freed on the error path. Free them on the rhashtable_lookup_insert_fast() error path in vxlan_vni_add(). Found by Linux Verification Center (linuxtesting.org). Fixes: 4095e0e1328a ("drivers: vxlan: vnifilter: per vni stats") Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru> --- drivers/net/vxlan/vxlan_vnifilter.c | 1 + 1 file changed, 1 insertion(+)