Re: [ovs-dev] memory leak in internal_dev_create
On Wed, Aug 07, 2019 at 01:32:40PM -0700, Pravin Shelar wrote: > On Tue, Aug 6, 2019 at 5:00 AM Hillf Danton wrote: > > > > > > On Tue, 06 Aug 2019 01:58:05 -0700 > > > Hello, > > > > > > syzbot found the following crash on: > > > > > ... > > > BUG: memory leak > > > unreferenced object 0x8881228ca500 (size 128): > > >comm "syz-executor032", pid 7015, jiffies 4294944622 (age 7.880s) > > >hex dump (first 32 bytes): > > > 00 f0 27 18 81 88 ff ff 80 ac 8c 22 81 88 ff ff ..'" > > > 40 b7 23 17 81 88 ff ff 00 00 00 00 00 00 00 00 @.#. > > >backtrace: > > > [<0eb78212>] kmemleak_alloc_recursive > > > include/linux/kmemleak.h:43 [inline] > > > [<0eb78212>] slab_post_alloc_hook mm/slab.h:522 [inline] > > > [<0eb78212>] slab_alloc mm/slab.c:3319 [inline] > > > [<0eb78212>] kmem_cache_alloc_trace+0x145/0x2c0 > > > mm/slab.c:3548 > > > [<006ea6c6>] kmalloc include/linux/slab.h:552 [inline] > > > [<006ea6c6>] kzalloc include/linux/slab.h:748 [inline] > > > [<006ea6c6>] ovs_vport_alloc+0x37/0xf0 > > > net/openvswitch/vport.c:130 > > > [] internal_dev_create+0x24/0x1d0 > > > net/openvswitch/vport-internal_dev.c:164 > > > [<56ee7c13>] ovs_vport_add+0x81/0x190 > > > net/openvswitch/vport.c:199 > > > [<5434efc7>] new_vport+0x19/0x80 > > > net/openvswitch/datapath.c:194 > > > [ ] ovs_dp_cmd_new+0x22f/0x410 > > > net/openvswitch/datapath.c:1614 > > > [ ] genl_family_rcv_msg+0x2ab/0x5b0 > > > net/netlink/genetlink.c:629 > > > [ ] genl_rcv_msg+0x54/0x9c > > > net/netlink/genetlink.c:654 > > > [<6694b647>] netlink_rcv_skb+0x61/0x170 > > > net/netlink/af_netlink.c:2477 > > > [<88381f37>] genl_rcv+0x29/0x40 net/netlink/genetlink.c:665 > > > [ ] netlink_unicast_kernel > > > net/netlink/af_netlink.c:1302 [inline] > > > [ ] netlink_unicast+0x1ec/0x2d0 > > > net/netlink/af_netlink.c:1328 > > > [<67e6b079>] netlink_sendmsg+0x270/0x480 > > > net/netlink/af_netlink.c:1917 > > > [ ] sock_sendmsg_nosec net/socket.c:637 [inline] > > > [ ] sock_sendmsg+0x54/0x70 net/socket.c:657 > > > [<4cb7c11d>] ___sys_sendmsg+0x393/0x3c0 net/socket.c:2311 > > > [ ] __sys_sendmsg+0x80/0xf0 net/socket.c:2356 > > > [ ] __do_sys_sendmsg net/socket.c:2365 [inline] > > > [ ] __se_sys_sendmsg net/socket.c:2363 [inline] > > > [ ] __x64_sys_sendmsg+0x23/0x30 net/socket.c:2363 > > > > > > Always free vport manually unless register_netdevice() succeeds. > > > > --- a/net/openvswitch/vport-internal_dev.c > > +++ b/net/openvswitch/vport-internal_dev.c > > @@ -137,7 +137,7 @@ static void do_setup(struct net_device * > > netdev->priv_flags |= IFF_LIVE_ADDR_CHANGE | IFF_OPENVSWITCH | > > IFF_NO_QUEUE; > > netdev->needs_free_netdev = true; > > - netdev->priv_destructor = internal_dev_destructor; > > + netdev->priv_destructor = NULL; > > netdev->ethtool_ops = &internal_dev_ethtool_ops; > > netdev->rtnl_link_ops = &internal_dev_link_ops; > > > > @@ -159,7 +159,6 @@ static struct vport *internal_dev_create > > struct internal_dev *internal_dev; > > struct net_device *dev; > > int err; > > - bool free_vport = true; > > > > vport = ovs_vport_alloc(0, &ovs_internal_vport_ops, parms); > > if (IS_ERR(vport)) { > > @@ -190,10 +189,9 @@ static struct vport *internal_dev_create > > > > rtnl_lock(); > > err = register_netdevice(vport->dev); > > - if (err) { > > - free_vport = false; > > + if (err) > > goto error_unlock; > > - } > > + vport->dev->priv_destructor = internal_dev_destructor; > > > I am not sure why have you moved this assignment out of do_setup(). > > Otherwise patch looks good to me. > > Thanks. Seems it's to avoid re-introducing the issue that was fixed by: commit 309b66970ee2abf721ecd0876a48940fa0b99a35 Author: Taehee Yoo Date: Sun Jun 9 23:26:21 2019 +0900 net: openvswitch: do not free vport if register_netdevice() is failed. A Fixes: 309b66970ee2a is welcomed then. > > dev_set_promiscuity(vport->dev, 1); > > rtnl_unlock(); > > @@ -207,8 +205,7 @@ error_unlock: > > error_free_netdev: > > free_netdev(dev); > > error_free_vport: > > - if (free_vport) > > - ovs_vport_free(vport); > > + ovs_vport_free(vport); > > error: > > return ERR_PTR(err); > > } > > -- > > > ___ dev mailing list d...@openvswitch.org https://mail.openvswitch.org/mailman/listinfo/ovs-dev
Re: [ovs-dev] memory leak in internal_dev_create
On Tue, Aug 6, 2019 at 5:00 AM Hillf Danton wrote: > > > On Tue, 06 Aug 2019 01:58:05 -0700 > > Hello, > > > > syzbot found the following crash on: > > ... > > BUG: memory leak > > unreferenced object 0x8881228ca500 (size 128): > >comm "syz-executor032", pid 7015, jiffies 4294944622 (age 7.880s) > >hex dump (first 32 bytes): > > 00 f0 27 18 81 88 ff ff 80 ac 8c 22 81 88 ff ff ..'" > > 40 b7 23 17 81 88 ff ff 00 00 00 00 00 00 00 00 @.#. > >backtrace: > > [<0eb78212>] kmemleak_alloc_recursive > > include/linux/kmemleak.h:43 [inline] > > [<0eb78212>] slab_post_alloc_hook mm/slab.h:522 [inline] > > [<0eb78212>] slab_alloc mm/slab.c:3319 [inline] > > [<0eb78212>] kmem_cache_alloc_trace+0x145/0x2c0 mm/slab.c:3548 > > [<006ea6c6>] kmalloc include/linux/slab.h:552 [inline] > > [<006ea6c6>] kzalloc include/linux/slab.h:748 [inline] > > [<006ea6c6>] ovs_vport_alloc+0x37/0xf0 > > net/openvswitch/vport.c:130 > > [] internal_dev_create+0x24/0x1d0 > > net/openvswitch/vport-internal_dev.c:164 > > [<56ee7c13>] ovs_vport_add+0x81/0x190 > > net/openvswitch/vport.c:199 > > [<5434efc7>] new_vport+0x19/0x80 net/openvswitch/datapath.c:194 > > [ ] ovs_dp_cmd_new+0x22f/0x410 > > net/openvswitch/datapath.c:1614 > > [ ] genl_family_rcv_msg+0x2ab/0x5b0 > > net/netlink/genetlink.c:629 > > [ ] genl_rcv_msg+0x54/0x9c net/netlink/genetlink.c:654 > > [<6694b647>] netlink_rcv_skb+0x61/0x170 > > net/netlink/af_netlink.c:2477 > > [<88381f37>] genl_rcv+0x29/0x40 net/netlink/genetlink.c:665 > > [ ] netlink_unicast_kernel > > net/netlink/af_netlink.c:1302 [inline] > > [ ] netlink_unicast+0x1ec/0x2d0 > > net/netlink/af_netlink.c:1328 > > [<67e6b079>] netlink_sendmsg+0x270/0x480 > > net/netlink/af_netlink.c:1917 > > [ ] sock_sendmsg_nosec net/socket.c:637 [inline] > > [ ] sock_sendmsg+0x54/0x70 net/socket.c:657 > > [<4cb7c11d>] ___sys_sendmsg+0x393/0x3c0 net/socket.c:2311 > > [ ] __sys_sendmsg+0x80/0xf0 net/socket.c:2356 > > [ ] __do_sys_sendmsg net/socket.c:2365 [inline] > > [ ] __se_sys_sendmsg net/socket.c:2363 [inline] > > [ ] __x64_sys_sendmsg+0x23/0x30 net/socket.c:2363 > > > Always free vport manually unless register_netdevice() succeeds. > > --- a/net/openvswitch/vport-internal_dev.c > +++ b/net/openvswitch/vport-internal_dev.c > @@ -137,7 +137,7 @@ static void do_setup(struct net_device * > netdev->priv_flags |= IFF_LIVE_ADDR_CHANGE | IFF_OPENVSWITCH | > IFF_NO_QUEUE; > netdev->needs_free_netdev = true; > - netdev->priv_destructor = internal_dev_destructor; > + netdev->priv_destructor = NULL; > netdev->ethtool_ops = &internal_dev_ethtool_ops; > netdev->rtnl_link_ops = &internal_dev_link_ops; > > @@ -159,7 +159,6 @@ static struct vport *internal_dev_create > struct internal_dev *internal_dev; > struct net_device *dev; > int err; > - bool free_vport = true; > > vport = ovs_vport_alloc(0, &ovs_internal_vport_ops, parms); > if (IS_ERR(vport)) { > @@ -190,10 +189,9 @@ static struct vport *internal_dev_create > > rtnl_lock(); > err = register_netdevice(vport->dev); > - if (err) { > - free_vport = false; > + if (err) > goto error_unlock; > - } > + vport->dev->priv_destructor = internal_dev_destructor; > I am not sure why have you moved this assignment out of do_setup(). Otherwise patch looks good to me. Thanks. > dev_set_promiscuity(vport->dev, 1); > rtnl_unlock(); > @@ -207,8 +205,7 @@ error_unlock: > error_free_netdev: > free_netdev(dev); > error_free_vport: > - if (free_vport) > - ovs_vport_free(vport); > + ovs_vport_free(vport); > error: > return ERR_PTR(err); > } > -- > ___ dev mailing list d...@openvswitch.org https://mail.openvswitch.org/mailman/listinfo/ovs-dev
Re: [ovs-dev] memory leak in internal_dev_create
On Tue, 06 Aug 2019 01:58:05 -0700 > Hello, > > syzbot found the following crash on: > > HEAD commit:1e78030e Merge tag 'mmc-v5.3-rc1' of git://git.kernel.org/.. > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=148d3d1a60 > kernel config: https://syzkaller.appspot.com/x/.config?x=30cef20daf3e9977 > dashboard link: https://syzkaller.appspot.com/bug?extid=13210896153522fe1ee5 > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=136aa8c460 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=109ba79260 > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > Reported-by: syzbot+13210896153522fe1...@syzkaller.appspotmail.com > > BUG: memory leak > unreferenced object 0x8881207e4100 (size 128): >comm "syz-executor032", pid 7014, jiffies 4294944027 (age 13.830s) >hex dump (first 32 bytes): > 00 70 16 18 81 88 ff ff 80 af 8c 22 81 88 ff ff .p." > 00 b6 23 17 81 88 ff ff 00 00 00 00 00 00 00 00 ..#. >backtrace: > [<0eb78212>] kmemleak_alloc_recursive > include/linux/kmemleak.h:43 [inline] > [<0eb78212>] slab_post_alloc_hook mm/slab.h:522 [inline] > [<0eb78212>] slab_alloc mm/slab.c:3319 [inline] > [<0eb78212>] kmem_cache_alloc_trace+0x145/0x2c0 mm/slab.c:3548 > [<006ea6c6>] kmalloc include/linux/slab.h:552 [inline] > [<006ea6c6>] kzalloc include/linux/slab.h:748 [inline] > [<006ea6c6>] ovs_vport_alloc+0x37/0xf0 > net/openvswitch/vport.c:130 > [] internal_dev_create+0x24/0x1d0 > net/openvswitch/vport-internal_dev.c:164 > [<56ee7c13>] ovs_vport_add+0x81/0x190 > net/openvswitch/vport.c:199 > [<5434efc7>] new_vport+0x19/0x80 net/openvswitch/datapath.c:194 > [ ] ovs_dp_cmd_new+0x22f/0x410 > net/openvswitch/datapath.c:1614 > [ ] genl_family_rcv_msg+0x2ab/0x5b0 > net/netlink/genetlink.c:629 > [ ] genl_rcv_msg+0x54/0x9c net/netlink/genetlink.c:654 > [<6694b647>] netlink_rcv_skb+0x61/0x170 > net/netlink/af_netlink.c:2477 > [<88381f37>] genl_rcv+0x29/0x40 net/netlink/genetlink.c:665 > [ ] netlink_unicast_kernel > net/netlink/af_netlink.c:1302 [inline] > [ ] netlink_unicast+0x1ec/0x2d0 > net/netlink/af_netlink.c:1328 > [<67e6b079>] netlink_sendmsg+0x270/0x480 > net/netlink/af_netlink.c:1917 > [ ] sock_sendmsg_nosec net/socket.c:637 [inline] > [ ] sock_sendmsg+0x54/0x70 net/socket.c:657 > [<4cb7c11d>] ___sys_sendmsg+0x393/0x3c0 net/socket.c:2311 > [ ] __sys_sendmsg+0x80/0xf0 net/socket.c:2356 > [ ] __do_sys_sendmsg net/socket.c:2365 [inline] > [ ] __se_sys_sendmsg net/socket.c:2363 [inline] > [ ] __x64_sys_sendmsg+0x23/0x30 net/socket.c:2363 > > BUG: memory leak > unreferenced object 0x88811723b600 (size 64): >comm "syz-executor032", pid 7014, jiffies 4294944027 (age 13.830s) >hex dump (first 32 bytes): > 01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 > 00 00 00 00 00 00 00 00 02 00 00 00 05 35 82 c1 .5.. >backtrace: > [<352f46d8>] kmemleak_alloc_recursive > include/linux/kmemleak.h:43 [inline] > [<352f46d8>] slab_post_alloc_hook mm/slab.h:522 [inline] > [<352f46d8>] slab_alloc mm/slab.c:3319 [inline] > [<352f46d8>] __do_kmalloc mm/slab.c:3653 [inline] > [<352f46d8>] __kmalloc+0x169/0x300 mm/slab.c:3664 > [<8e48f3d1>] kmalloc include/linux/slab.h:557 [inline] > [<8e48f3d1>] ovs_vport_set_upcall_portids+0x54/0xd0 > net/openvswitch/vport.c:343 > [<541e4f4a>] ovs_vport_alloc+0x7f/0xf0 > net/openvswitch/vport.c:139 > [ ] internal_dev_create+0x24/0x1d0 > net/openvswitch/vport-internal_dev.c:164 > [<56ee7c13>] ovs_vport_add+0x81/0x190 > net/openvswitch/vport.c:199 > [<5434efc7>] new_vport+0x19/0x80 net/openvswitch/datapath.c:194 > [ ] ovs_dp_cmd_new+0x22f/0x410 > net/openvswitch/datapath.c:1614 > [ ] genl_family_rcv_msg+0x2ab/0x5b0 > net/netlink/genetlink.c:629 > [ ] genl_rcv_msg+0x54/0x9c net/netlink/genetlink.c:654 > [<6694b647>] netlink_rcv_skb+0x61/0x170 > net/netlink/af_netlink.c:2477 > [<88381f37>] genl_rcv+0x29/0x40 net/netlink/genetlink.c:665 > [ ] netlink_unicast_kernel > net/netlink/af_netlink.c:1302 [inline] > [ ] netlink_unicast+0x1ec/0x2d0 > net/netlink/af_netlink.c:1328 > [<67e6b079>] netlink_
[ovs-dev] memory leak in internal_dev_create
Hello, syzbot found the following crash on: HEAD commit:1e78030e Merge tag 'mmc-v5.3-rc1' of git://git.kernel.org/.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=148d3d1a60 kernel config: https://syzkaller.appspot.com/x/.config?x=30cef20daf3e9977 dashboard link: https://syzkaller.appspot.com/bug?extid=13210896153522fe1ee5 compiler: gcc (GCC) 9.0.0 20181231 (experimental) syz repro: https://syzkaller.appspot.com/x/repro.syz?x=136aa8c460 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=109ba79260 IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+13210896153522fe1...@syzkaller.appspotmail.com BUG: memory leak unreferenced object 0x8881207e4100 (size 128): comm "syz-executor032", pid 7014, jiffies 4294944027 (age 13.830s) hex dump (first 32 bytes): 00 70 16 18 81 88 ff ff 80 af 8c 22 81 88 ff ff .p." 00 b6 23 17 81 88 ff ff 00 00 00 00 00 00 00 00 ..#. backtrace: [<0eb78212>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline] [<0eb78212>] slab_post_alloc_hook mm/slab.h:522 [inline] [<0eb78212>] slab_alloc mm/slab.c:3319 [inline] [<0eb78212>] kmem_cache_alloc_trace+0x145/0x2c0 mm/slab.c:3548 [<006ea6c6>] kmalloc include/linux/slab.h:552 [inline] [<006ea6c6>] kzalloc include/linux/slab.h:748 [inline] [<006ea6c6>] ovs_vport_alloc+0x37/0xf0 net/openvswitch/vport.c:130 [] internal_dev_create+0x24/0x1d0 net/openvswitch/vport-internal_dev.c:164 [<56ee7c13>] ovs_vport_add+0x81/0x190 net/openvswitch/vport.c:199 [<5434efc7>] new_vport+0x19/0x80 net/openvswitch/datapath.c:194 [ ] ovs_dp_cmd_new+0x22f/0x410 net/openvswitch/datapath.c:1614 [ ] genl_family_rcv_msg+0x2ab/0x5b0 net/netlink/genetlink.c:629 [ ] genl_rcv_msg+0x54/0x9c net/netlink/genetlink.c:654 [<6694b647>] netlink_rcv_skb+0x61/0x170 net/netlink/af_netlink.c:2477 [<88381f37>] genl_rcv+0x29/0x40 net/netlink/genetlink.c:665 [ ] netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline] [ ] netlink_unicast+0x1ec/0x2d0 net/netlink/af_netlink.c:1328 [<67e6b079>] netlink_sendmsg+0x270/0x480 net/netlink/af_netlink.c:1917 [ ] sock_sendmsg_nosec net/socket.c:637 [inline] [ ] sock_sendmsg+0x54/0x70 net/socket.c:657 [<4cb7c11d>] ___sys_sendmsg+0x393/0x3c0 net/socket.c:2311 [ ] __sys_sendmsg+0x80/0xf0 net/socket.c:2356 [ ] __do_sys_sendmsg net/socket.c:2365 [inline] [ ] __se_sys_sendmsg net/socket.c:2363 [inline] [ ] __x64_sys_sendmsg+0x23/0x30 net/socket.c:2363 BUG: memory leak unreferenced object 0x88811723b600 (size 64): comm "syz-executor032", pid 7014, jiffies 4294944027 (age 13.830s) hex dump (first 32 bytes): 01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 05 35 82 c1 .5.. backtrace: [<352f46d8>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline] [<352f46d8>] slab_post_alloc_hook mm/slab.h:522 [inline] [<352f46d8>] slab_alloc mm/slab.c:3319 [inline] [<352f46d8>] __do_kmalloc mm/slab.c:3653 [inline] [<352f46d8>] __kmalloc+0x169/0x300 mm/slab.c:3664 [<8e48f3d1>] kmalloc include/linux/slab.h:557 [inline] [<8e48f3d1>] ovs_vport_set_upcall_portids+0x54/0xd0 net/openvswitch/vport.c:343 [<541e4f4a>] ovs_vport_alloc+0x7f/0xf0 net/openvswitch/vport.c:139 [ ] internal_dev_create+0x24/0x1d0 net/openvswitch/vport-internal_dev.c:164 [<56ee7c13>] ovs_vport_add+0x81/0x190 net/openvswitch/vport.c:199 [<5434efc7>] new_vport+0x19/0x80 net/openvswitch/datapath.c:194 [ ] ovs_dp_cmd_new+0x22f/0x410 net/openvswitch/datapath.c:1614 [ ] genl_family_rcv_msg+0x2ab/0x5b0 net/netlink/genetlink.c:629 [ ] genl_rcv_msg+0x54/0x9c net/netlink/genetlink.c:654 [<6694b647>] netlink_rcv_skb+0x61/0x170 net/netlink/af_netlink.c:2477 [<88381f37>] genl_rcv+0x29/0x40 net/netlink/genetlink.c:665 [ ] netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline] [ ] netlink_unicast+0x1ec/0x2d0 net/netlink/af_netlink.c:1328 [<67e6b079>] netlink_sendmsg+0x270/0x480 net/netlink/af_netlink.c:1917 [ ] sock_sendmsg_nosec net/socket.c:637 [inline] [ ] sock_sendmsg+0x54/0x70 net/socket.c:657 [<4cb7c11d>] ___sys_sendmsg+0x393/0x3c0 net/socket.c:2311 [<000
