Patch "bridge: mdb: fix leak on complete_info ptr on fail path" has been added to the 4.12-stable tree

From foo@baz Mon Jul 17 18:46:41 CEST 2017

This is a note to let you know that I've just added the patch titled

bridge: mdb: fix leak on complete_info ptr on fail path

to the 4.12-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
bridge-mdb-fix-leak-on-complete_info-ptr-on-fail-path.patch
and it can be found in the queue-4.12 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From foo@baz Mon Jul 17 18:46:41 CEST 2017
From: Eduardo Valentin <[email protected]>
Date: Tue, 11 Jul 2017 14:55:12 -0700
Subject: bridge: mdb: fix leak on complete_info ptr on fail path

From: Eduardo Valentin <[email protected]>

[ Upstream commit 1bfb159673957644951ab0a8d2aec44b93ddb1ae ]

We currently get the following kmemleak report:
unreferenced object 0xffff8800039d9820 (size 32):
comm "softirq", pid 0, jiffies 4295212383 (age 792.416s) hex dump (first 32 bytes):

    00 0c e0 03 00 88 ff ff ff 02 00 00 00 00 00 00  ................
    00 00 00 01 ff 11 00 02 86 dd 00 00 ff ff ff ff  ................
  backtrace:
    [<ffffffff8152b4aa>] kmemleak_alloc+0x4a/0xa0
    [<ffffffff811d8ec8>] kmem_cache_alloc_trace+0xb8/0x1c0
    [<ffffffffa0389683>] __br_mdb_notify+0x2a3/0x300 [bridge]
    [<ffffffffa038a0ce>] br_mdb_notify+0x6e/0x70 [bridge]
    [<ffffffffa0386479>] br_multicast_add_group+0x109/0x150 [bridge]
    [<ffffffffa0386518>] br_ip6_multicast_add_group+0x58/0x60 [bridge]
    [<ffffffffa0387fb5>] br_multicast_rcv+0x1d5/0xdb0 [bridge]
    [<ffffffffa037d7cf>] br_handle_frame_finish+0xcf/0x510 [bridge]
    [<ffffffffa03a236b>] br_nf_hook_thresh.part.27+0xb/0x10 [br_netfilter]
    [<ffffffffa03a3738>] br_nf_hook_thresh+0x48/0xb0 [br_netfilter]
    [<ffffffffa03a3fb9>] br_nf_pre_routing_finish_ipv6+0x109/0x1d0 [br_netfilter]
    [<ffffffffa03a4400>] br_nf_pre_routing_ipv6+0xd0/0x14c [br_netfilter]
    [<ffffffffa03a3c27>] br_nf_pre_routing+0x197/0x3d0 [br_netfilter]
    [<ffffffff814a2952>] nf_iterate+0x52/0x60
    [<ffffffff814a29bc>] nf_hook_slow+0x5c/0xb0
    [<ffffffffa037ddf4>] br_handle_frame+0x1a4/0x2c0 [bridge]

This happens when switchdev_port_obj_add() fails. This patch frees complete_info object in the fail path.

Reviewed-by Vallish Vaidyeshwara <[email protected]>

Signed-off-by Eduardo Valentin <[email protected]>

Signed-off-by David S. Miller <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 net/bridge/br_mdb.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

net/bridge/br_mdb.c +2 -1

@@ -323,7 +323,8 @@ static void __br_mdb_notify(struct net_d
 			__mdb_entry_to_br_ip(entry, &complete_info->ip);
 			mdb.obj.complete_priv = complete_info;
 			mdb.obj.complete = br_mdb_complete;
-			switchdev_port_obj_add(port_dev, &mdb.obj);
+			if (switchdev_port_obj_add(port_dev, &mdb.obj))
+				kfree(complete_info);
 		}
 	} else if (port_dev && type == RTM_DELMDB) {
 		switchdev_port_obj_del(port_dev, &mdb.obj);

Patches currently in stable-queue which might be from [email protected] are

queue-4.12/bridge-mdb-fix-leak-on-complete_info-ptr-on-fail-path.patch

Greg,

Quoted 5 lines · On Mon, Jul 17, 2017 at 06:52:21PM +0200, [email protected] wrote:

This is a note to let you know that I've just added the patch titled

bridge: mdb: fix leak on complete_info ptr on fail path

Quoted 6 lines

to the 4.12-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
bridge-mdb-fix-leak-on-complete_info-ptr-on-fail-path.patch
and it can be found in the queue-4.12 subdirectory.

Can we get this patch also in the 4.9.y queue?

Quoted 12 lines · Eduardo Valentin

Greg,

Quoted 8 lines · On Mon, Jul 17, 2017 at 06:52:21PM +0200, [email protected] wrote:

This is a note to let you know that I've just added the patch titled

bridge: mdb: fix leak on complete_info ptr on fail path

to the 4.12-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

Quoted 5 lines

Quoted 3 lines

The filename of the patch is:
bridge-mdb-fix-leak-on-complete_info-ptr-on-fail-path.patch
and it can be found in the queue-4.12 subdirectory.

Can we get this patch also in the 4.9.y queue?

Yes, please wait, I'm working on seeing what else needs to be backported to older stable kernels at the moment...