Li RongQing
2018-Oct-14 03:21 UTC
[Bridge] [PATCH] net: bridge: fix a memory leak in __vlan_add
After per-port vlan stats, vlan stats should be released
when fail to add vlan
Fixes: 9163a0fc1f0c0 ("net: bridge: add support for per-port vlan
stats")
cc: Nikolay Aleksandrov <nikolay at cumulusnetworks.com>
Signed-off-by: Zhang Yu <zhangyu31 at baidu.com>
Signed-off-by: Li RongQing <lirongqing at baidu.com>
---
net/bridge/br_vlan.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
index 9b707234e4ae..e08e269041dd 100644
--- a/net/bridge/br_vlan.c
+++ b/net/bridge/br_vlan.c
@@ -305,6 +305,10 @@ static int __vlan_add(struct net_bridge_vlan *v, u16 flags)
if (masterv) {
br_vlan_put_master(masterv);
v->brvlan = NULL;
+
+ if (masterv->stats != v->stats && v->stats)
+ free_percpu(v->stats);
+ v->stats = NULL;
}
} else {
br_switchdev_port_vlan_del(dev, v->vid);
--
2.16.2
Nikolay Aleksandrov
2018-Oct-14 15:33 UTC
[Bridge] [PATCH] net: bridge: fix a memory leak in __vlan_add
On 14/10/2018 06:21, Li RongQing wrote:> After per-port vlan stats, vlan stats should be released > when fail to add vlan > > Fixes: 9163a0fc1f0c0 ("net: bridge: add support for per-port vlan stats") > cc: Nikolay Aleksandrov <nikolay at cumulusnetworks.com> > Signed-off-by: Zhang Yu <zhangyu31 at baidu.com> > Signed-off-by: Li RongQing <lirongqing at baidu.com> > --- > net/bridge/br_vlan.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c > index 9b707234e4ae..e08e269041dd 100644 > --- a/net/bridge/br_vlan.c > +++ b/net/bridge/br_vlan.c > @@ -305,6 +305,10 @@ static int __vlan_add(struct net_bridge_vlan *v, u16 flags) > if (masterv) { > br_vlan_put_master(masterv); > v->brvlan = NULL; > + > + if (masterv->stats != v->stats && v->stats) > + free_percpu(v->stats); > + v->stats = NULL; > } > } else { > br_switchdev_port_vlan_del(dev, v->vid); >Hi, Good catch, but the patch doesn't fix the bug entirely. The problem is that masterv can be created just for this vlan and the br_vlan_put_master() above can free it, so we can check a pointer that's not really up-to-date (and thus again leak memory). You should move the new code above the br_vlan_put_master() call. Also please tag the proper branch, this is for net-next, and CC all bridge maintainers (added Roopa). Thank you, Nik