net: fix percpu memory leaks
This patch fixes following problems : 1) percpu_counter_init() can return an error, therefore init_frag_mem_limit() must propagate this error so that inet_frags_init_net() can do the same up to its callers. 2) If ip[46]_frags_ns_ctl_register() fail, we must unwind properly and free the percpu_counter. Without this fix, we leave freed object in percpu_counters global list (if CONFIG_HOTPLUG_CPU) leading to crashes. This bug was detected by KASAN and syzkaller tool (http://github.com/google/syzkaller ) Fixes: 6d7b857d ("net: use lib/percpu_counter API for fragmentation mem accounting") Signed-off-by:Eric Dumazet <edumazet@google.com> Reported-by:
Dmitry Vyukov <dvyukov@google.com> Cc: Hannes Frederic Sowa <hannes@stressinduktion.org> Cc: Jesper Dangaard Brouer <brouer@redhat.com> Acked-by:
Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by:
David S. Miller <davem@davemloft.net>
Showing
- include/net/inet_frag.h 9 additions, 6 deletionsinclude/net/inet_frag.h
- net/ieee802154/6lowpan/reassembly.c 8 additions, 3 deletionsnet/ieee802154/6lowpan/reassembly.c
- net/ipv4/inet_fragment.c 0 additions, 6 deletionsnet/ipv4/inet_fragment.c
- net/ipv4/ip_fragment.c 9 additions, 3 deletionsnet/ipv4/ip_fragment.c
- net/ipv6/netfilter/nf_conntrack_reasm.c 9 additions, 3 deletionsnet/ipv6/netfilter/nf_conntrack_reasm.c
- net/ipv6/reassembly.c 9 additions, 3 deletionsnet/ipv6/reassembly.c
Loading
Please register or sign in to comment