BugLink: https://bugs.launchpad.net/bugs/1885942
[ Upstream commit
814152a89ed52c722ab92e9fbabcac3cb8a39245 ]
I got a memleak report when doing some fuzz test:
unreferenced object 0xffff888112584000 (size 13599):
comm "ip", pid 3048, jiffies
4294911734 (age 343.491s)
hex dump (first 32 bytes):
74 61 70 30 00 00 00 00 00 00 00 00 00 00 00 00 tap0............
00 ee d9 19 81 88 ff ff 00 00 00 00 00 00 00 00 ................
backtrace:
[<
000000002f60ba65>] __kmalloc_node+0x309/0x3a0
[<
0000000075b211ec>] kvmalloc_node+0x7f/0xc0
[<
00000000d3a97396>] alloc_netdev_mqs+0x76/0xfc0
[<
00000000609c3655>] __tun_chr_ioctl+0x1456/0x3d70
[<
000000001127ca24>] ksys_ioctl+0xe5/0x130
[<
00000000b7d5e66a>] __x64_sys_ioctl+0x6f/0xb0
[<
00000000e1023498>] do_syscall_64+0x56/0xa0
[<
000000009ec0eb12>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
unreferenced object 0xffff888111845cc0 (size 8):
comm "ip", pid 3048, jiffies
4294911734 (age 343.491s)
hex dump (first 8 bytes):
74 61 70 30 00 88 ff ff tap0....
backtrace:
[<
000000004c159777>] kstrdup+0x35/0x70
[<
00000000d8b496ad>] kstrdup_const+0x3d/0x50
[<
00000000494e884a>] kvasprintf_const+0xf1/0x180
[<
0000000097880a2b>] kobject_set_name_vargs+0x56/0x140
[<
000000008fbdfc7b>] dev_set_name+0xab/0xe0
[<
000000005b99e3b4>] netdev_register_kobject+0xc0/0x390
[<
00000000602704fe>] register_netdevice+0xb61/0x1250
[<
000000002b7ca244>] __tun_chr_ioctl+0x1cd1/0x3d70
[<
000000001127ca24>] ksys_ioctl+0xe5/0x130
[<
00000000b7d5e66a>] __x64_sys_ioctl+0x6f/0xb0
[<
00000000e1023498>] do_syscall_64+0x56/0xa0
[<
000000009ec0eb12>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
unreferenced object 0xffff88811886d800 (size 512):
comm "ip", pid 3048, jiffies
4294911734 (age 343.491s)
hex dump (first 32 bytes):
00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N..........
ff ff ff ff ff ff ff ff c0 66 3d a3 ff ff ff ff .........f=.....
backtrace:
[<
0000000050315800>] device_add+0x61e/0x1950
[<
0000000021008dfb>] netdev_register_kobject+0x17e/0x390
[<
00000000602704fe>] register_netdevice+0xb61/0x1250
[<
000000002b7ca244>] __tun_chr_ioctl+0x1cd1/0x3d70
[<
000000001127ca24>] ksys_ioctl+0xe5/0x130
[<
00000000b7d5e66a>] __x64_sys_ioctl+0x6f/0xb0
[<
00000000e1023498>] do_syscall_64+0x56/0xa0
[<
000000009ec0eb12>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
If call_netdevice_notifiers() failed, then rollback_registered()
calls netdev_unregister_kobject() which holds the kobject. The
reference cannot be put because the netdev won't be add to todo
list, so it will leads a memleak, we need put the reference to
avoid memleak.
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Kelsey Skunberg <kelsey.skunberg@canonical.com>