linux/net/core
Weilong Chen ddb5bba463 rtnetlink: Fix memory(net_device) leak when ->newlink fails
[ Upstream commit cebb69754f ]

When vlan_newlink call register_vlan_dev fails, it might return error
with dev->reg_state = NETREG_UNREGISTERED. The rtnl_newlink should
free the memory. But currently rtnl_newlink only free the memory which
state is NETREG_UNINITIALIZED.

BUG: memory leak
unreferenced object 0xffff8881051de000 (size 4096):
  comm "syz-executor139", pid 560, jiffies 4294745346 (age 32.445s)
  hex dump (first 32 bytes):
    76 6c 61 6e 32 00 00 00 00 00 00 00 00 00 00 00  vlan2...........
    00 45 28 03 81 88 ff ff 00 00 00 00 00 00 00 00  .E(.............
  backtrace:
    [<0000000047527e31>] kmalloc_node include/linux/slab.h:578 [inline]
    [<0000000047527e31>] kvmalloc_node+0x33/0xd0 mm/util.c:574
    [<000000002b59e3bc>] kvmalloc include/linux/mm.h:753 [inline]
    [<000000002b59e3bc>] kvzalloc include/linux/mm.h:761 [inline]
    [<000000002b59e3bc>] alloc_netdev_mqs+0x83/0xd90 net/core/dev.c:9929
    [<000000006076752a>] rtnl_create_link+0x2c0/0xa20 net/core/rtnetlink.c:3067
    [<00000000572b3be5>] __rtnl_newlink+0xc9c/0x1330 net/core/rtnetlink.c:3329
    [<00000000e84ea553>] rtnl_newlink+0x66/0x90 net/core/rtnetlink.c:3397
    [<0000000052c7c0a9>] rtnetlink_rcv_msg+0x540/0x990 net/core/rtnetlink.c:5460
    [<000000004b5cb379>] netlink_rcv_skb+0x12b/0x3a0 net/netlink/af_netlink.c:2469
    [<00000000c71c20d3>] netlink_unicast_kernel net/netlink/af_netlink.c:1303 [inline]
    [<00000000c71c20d3>] netlink_unicast+0x4c6/0x690 net/netlink/af_netlink.c:1329
    [<00000000cca72fa9>] netlink_sendmsg+0x735/0xcc0 net/netlink/af_netlink.c:1918
    [<000000009221ebf7>] sock_sendmsg_nosec net/socket.c:652 [inline]
    [<000000009221ebf7>] sock_sendmsg+0x109/0x140 net/socket.c:672
    [<000000001c30ffe4>] ____sys_sendmsg+0x5f5/0x780 net/socket.c:2352
    [<00000000b71ca6f3>] ___sys_sendmsg+0x11d/0x1a0 net/socket.c:2406
    [<0000000007297384>] __sys_sendmsg+0xeb/0x1b0 net/socket.c:2439
    [<000000000eb29b11>] do_syscall_64+0x56/0xa0 arch/x86/entry/common.c:359
    [<000000006839b4d0>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fixes: cb626bf566 ("net-sysfs: Fix reference count leak")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Weilong Chen <chenweilong@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-07-31 18:37:49 +02:00
..
datagram.c net: add READ_ONCE() annotation in __skb_wait_for_more_packets() 2019-11-10 11:27:49 +01:00
dev_addr_lists.c
dev_ioctl.c net: remove redundant input checks in SIOCSIFTXQLEN case of dev_ifsioc 2018-07-24 11:36:15 -07:00
dev.c dev: Defer free of skbs in flush_backlog 2020-07-31 18:37:47 +02:00
devlink.c devlink: validate length of region addr/len 2020-03-18 07:14:18 +01:00
drop_monitor.c drop_monitor: work around gcc-10 stringop-overflow warning 2020-05-20 08:18:33 +02:00
dst_cache.c
dst.c netfilter: nf_tables: add tunnel support 2018-08-03 21:12:12 +02:00
ethtool.c ethtool: reduce stack usage with clang 2020-01-17 19:46:55 +01:00
failover.c failover: allow name change on IFF_UP slave interfaces 2019-04-27 09:36:30 +02:00
fib_notifier.c
fib_rules.c net: fib_rules: Correctly set table field when table number exceeds 8 bits 2020-03-05 16:42:15 +01:00
filter.c sched: consistently handle layer3 header accesses in the presence of VLANs 2020-07-22 09:32:00 +02:00
flow_dissector.c net: dsa: fix flow dissection on Tx path 2019-12-21 10:57:11 +01:00
gen_estimator.c net: core: protect rate estimator statistics pointer with lock 2018-08-11 12:37:10 -07:00
gen_stats.c net: sched: put back q.qlen into a single location 2019-03-10 07:17:16 +01:00
gro_cells.c gro_cells: make sure device is up in gro_cells_receive() 2019-03-19 13:12:38 +01:00
hwbm.c
link_watch.c
lwt_bpf.c bpf: in __bpf_redirect_no_mac pull mac only if present 2019-01-22 21:40:35 +01:00
lwtunnel.c
Makefile
neighbour.c net: neigh: use long type to store jiffies delta 2020-01-27 14:51:21 +01:00
net_namespace.c net/net_namespace: Check the return value of register_pernet_subsys() 2019-12-05 09:20:51 +01:00
net-procfs.c
net-sysfs.c net-sysfs: add a newline when printing 'tx_timeout' by sysfs 2020-07-31 18:37:47 +02:00
net-sysfs.h
net-traces.c
netclassid_cgroup.c cgroup, netclassid: remove double cond_resched 2020-05-10 10:30:12 +02:00
netevent.c
netpoll.c net: fix skb use after free in netpoll 2019-09-10 10:33:38 +01:00
netprio_cgroup.c netprio_cgroup: Fix unlimited memory leak of v2 cgroups 2020-05-20 08:18:38 +02:00
page_pool.c net/page_pool: Fix inconsistent lock state warning 2018-07-19 23:23:01 -07:00
pktgen.c pktgen: do not sleep with the thread lock held. 2019-06-11 12:20:49 +02:00
ptp_classifier.c
request_sock.c
rtnetlink.c rtnetlink: Fix memory(net_device) leak when ->newlink fails 2020-07-31 18:37:49 +02:00
scm.c
secure_seq.c infiniband: i40iw, nes: don't use wall time for TCP sequence numbers 2018-07-11 12:10:19 -06:00
skbuff.c net: gso: Fix skb_segment splat when splitting gso_size mangled skb having linear-headed frag_list 2019-09-19 09:09:30 +02:00
sock_diag.c net: sock_diag: Fix spectre v1 gadget in __sock_diag_cmd() 2018-08-14 10:01:24 -07:00
sock_reuseport.c udp: Copy has_conns in reuseport_grow(). 2020-07-31 18:37:48 +02:00
sock.c cgroup: fix cgroup_sk_alloc() for sk_clone_lock() 2020-07-22 09:32:00 +02:00
stream.c tcp: make sure EPOLLOUT wont be missed 2019-09-06 10:22:07 +02:00
sysctl_net_core.c bpf: Check correct cred for CAP_SYSLOG in bpf_dump_raw_ok() 2020-07-16 08:17:27 +02:00
timestamping.c
tso.c
utils.c net: Fix skb->csum update in inet_proto_csum_replace16(). 2020-02-05 14:43:53 +00:00
xdp.c net/xdp: Fix suspicious RCU usage warning 2018-08-16 21:55:21 +02:00