Eric Dumazet 09d4f10a5e net: sched: act_ctinfo: fix memory leak ... Implement a cleanup method to properly free ci->params BUG: memory leak unreferenced object 0xffff88811746e2c0 (size 64): comm "syz-executor617", pid 7106, jiffies 4294943055 (age 14.250s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ c0 34 60 84 ff ff ff ff 00 00 00 00 00 00 00 00 .4`............. backtrace: [<0000000015aa236f>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline] [<0000000015aa236f>] slab_post_alloc_hook mm/slab.h:586 [inline] [<0000000015aa236f>] slab_alloc mm/slab.c:3320 [inline] [<0000000015aa236f>] kmem_cache_alloc_trace+0x145/0x2c0 mm/slab.c:3549 [<000000002c946bd1>] kmalloc include/linux/slab.h:556 [inline] [<000000002c946bd1>] kzalloc include/linux/slab.h:670 [inline] [<000000002c946bd1>] tcf_ctinfo_init+0x21a/0x530 net/sched/act_ctinfo.c:236 [<0000000086952cca>] tcf_action_init_1+0x400/0x5b0 net/sched/act_api.c:944 [<000000005ab29bf8>] tcf_action_init+0x135/0x1c0 net/sched/act_api.c:1000 [<00000000392f56f9>] tcf_action_add+0x9a/0x200 net/sched/act_api.c:1410 [<0000000088f3c5dd>] tc_ctl_action+0x14d/0x1bb net/sched/act_api.c:1465 [<000000006b39d986>] rtnetlink_rcv_msg+0x178/0x4b0 net/core/rtnetlink.c:5424 [<00000000fd6ecace>] netlink_rcv_skb+0x61/0x170 net/netlink/af_netlink.c:2477 [<0000000047493d02>] rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5442 [<00000000bdcf8286>] netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline] [<00000000bdcf8286>] netlink_unicast+0x223/0x310 net/netlink/af_netlink.c:1328 [<00000000fc5b92d9>] netlink_sendmsg+0x2c0/0x570 net/netlink/af_netlink.c:1917 [<00000000da84d076>] sock_sendmsg_nosec net/socket.c:639 [inline] [<00000000da84d076>] sock_sendmsg+0x54/0x70 net/socket.c:659 [<0000000042fb2eee>] ____sys_sendmsg+0x2d0/0x300 net/socket.c:2330 [<000000008f23f67e>] ___sys_sendmsg+0x8a/0xd0 net/socket.c:2384 [<00000000d838e4f6>] __sys_sendmsg+0x80/0xf0 net/socket.c:2417 [<00000000289a9cb1>] __do_sys_sendmsg net/socket.c:2426 [inline] [<00000000289a9cb1>] __se_sys_sendmsg net/socket.c:2424 [inline] [<00000000289a9cb1>] __x64_sys_sendmsg+0x23/0x30 net/socket.c:2424 Fixes: 24ec483cec ("net: sched: Introduce act_ctinfo action") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Cc: Kevin 'ldir' Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> Cc: Cong Wang <xiyou.wangcong@gmail.com> Cc: Toke Høiland-Jørgensen <toke@redhat.com> Acked-by: Kevin 'ldir' Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> Signed-off-by: David S. Miller <davem@davemloft.net>		2020-01-19 16:02:15 +01:00
..
act_api.c
act_bpf.c
act_connmark.c
act_csum.c
act_ct.c	treewide: Use sizeof_field() macro	2019-12-09 10:36:44 -08:00
act_ctinfo.c	net: sched: act_ctinfo: fix memory leak	2020-01-19 16:02:15 +01:00
act_gact.c
act_ife.c	net/sched: act_ife: initalize ife->metalist earlier	2020-01-17 10:58:15 +01:00
act_ipt.c
act_meta_mark.c
act_meta_skbprio.c
act_meta_skbtcindex.c
act_mirred.c	net/sched: act_mirred: Pull mac prior redir to non mac_header_xmit device	2019-12-27 16:35:32 -08:00
act_mpls.c	net: Fixed updating of ethertype in skb_mpls_push()	2019-12-04 17:11:25 -08:00
act_nat.c
act_pedit.c
act_police.c
act_sample.c
act_simple.c
act_skbedit.c
act_skbmod.c
act_tunnel_key.c
act_vlan.c
cls_api.c	net/sched: add delete_empty() to filters and use it in cls_flower	2019-12-30 20:35:19 -08:00
cls_basic.c
cls_bpf.c
cls_cgroup.c
cls_flow.c
cls_flower.c	net/sched: add delete_empty() to filters and use it in cls_flower	2019-12-30 20:35:19 -08:00
cls_fw.c
cls_matchall.c
cls_route.c
cls_rsvp6.c
cls_rsvp.c
cls_rsvp.h
cls_tcindex.c
cls_u32.c	net/sched: add delete_empty() to filters and use it in cls_flower	2019-12-30 20:35:19 -08:00
em_canid.c
em_cmp.c
em_ipset.c
em_ipt.c
em_meta.c
em_nbyte.c
em_text.c
em_u32.c
ematch.c
Kconfig
Makefile
sch_api.c
sch_atm.c
sch_blackhole.c
sch_cake.c	sch_cake: avoid possible divide by zero in cake_enqueue()	2020-01-02 16:34:28 -08:00
sch_cbq.c
sch_cbs.c
sch_choke.c
sch_codel.c
sch_drr.c
sch_dsmark.c
sch_etf.c
sch_fifo.c
sch_fq_codel.c
sch_fq.c	pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM	2020-01-08 12:40:47 -08:00
sch_generic.c
sch_gred.c
sch_hfsc.c
sch_hhf.c
sch_htb.c
sch_ingress.c
sch_mq.c	net: sched: fix dump qlen for sch_mq/sch_mqprio with NOLOCK subqueues	2019-12-03 11:53:55 -08:00
sch_mqprio.c	mqprio: Fix out-of-bounds access in mqprio_dump	2019-12-06 11:58:45 -08:00
sch_multiq.c
sch_netem.c
sch_pie.c
sch_plug.c
sch_prio.c	net: sch_prio: When ungrafting, replace with FIFO	2020-01-08 12:45:53 -08:00
sch_qfq.c
sch_red.c
sch_sfb.c
sch_sfq.c
sch_skbprio.c
sch_taprio.c
sch_tbf.c
sch_teql.c