1. Patchew
  2. linux
  3. View series

[PATCH] net: sched: em_text: fix possible memory leak in em_text_destroy()

Hangyu Hua posted 1 patch 1 year, 12 months ago
There is a newer version of this series
net/sched/em_text.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
[PATCH] net: sched: em_text: fix possible memory leak in em_text_destroy()
Posted by Hangyu Hua 1 year, 12 months ago 
m->data needs to be freed when em_text_destroy is called.

Fixes: d675c989ed2d ("[PKT_SCHED]: Packet classification based on textsearch (ematch)")
Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
---
 net/sched/em_text.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/sched/em_text.c b/net/sched/em_text.c
index 6f3c1fb2fb44..b9d5d4dca2c9 100644
--- a/net/sched/em_text.c
+++ b/net/sched/em_text.c
@@ -97,8 +97,10 @@ static int em_text_change(struct net *net, void *data, int len,
 
 static void em_text_destroy(struct tcf_ematch *m)
 {
-	if (EM_TEXT_PRIV(m) && EM_TEXT_PRIV(m)->config)
+	if (EM_TEXT_PRIV(m) && EM_TEXT_PRIV(m)->config) {
 		textsearch_destroy(EM_TEXT_PRIV(m)->config);
+		kfree(m->data);
+	}
 }
 
 static int em_text_dump(struct sk_buff *skb, struct tcf_ematch *m)
-- 
2.34.1
Re: [PATCH] net: sched: em_text: fix possible memory leak in em_text_destroy()
Posted by kernel test robot 1 year, 12 months ago 
Hi Hangyu,

kernel test robot noticed the following build errors:

[auto build test ERROR on net-next/main]
[also build test ERROR on net/main linus/master v6.7-rc6 next-20231220]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Hangyu-Hua/net-sched-em_text-fix-possible-memory-leak-in-em_text_destroy/20231220-111317
base:   net-next/main
patch link:    https://lore.kernel.org/r/20231220030838.11751-1-hbh25y%40gmail.com
patch subject: [PATCH] net: sched: em_text: fix possible memory leak in em_text_destroy()
config: x86_64-rhel-8.3-rust (https://download.01.org/0day-ci/archive/20231221/202312210705.j1LTJmpH-lkp@intel.com/config)
compiler: clang version 16.0.4 (https://github.com/llvm/llvm-project.git ae42196bc493ffe877a7e3dff8be32035dea4d07)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20231221/202312210705.j1LTJmpH-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202312210705.j1LTJmpH-lkp@intel.com/

All errors (new ones prefixed by >>):

>> net/sched/em_text.c:102:9: error: incompatible integer to pointer conversion passing 'unsigned long' to parameter of type 'const void *' [-Wint-conversion]
                   kfree(m->data);
                         ^~~~~~~
   include/linux/slab.h:227:24: note: passing argument to parameter 'objp' here
   void kfree(const void *objp);
                          ^
   1 error generated.


vim +102 net/sched/em_text.c

    97	
    98	static void em_text_destroy(struct tcf_ematch *m)
    99	{
   100		if (EM_TEXT_PRIV(m) && EM_TEXT_PRIV(m)->config) {
   101			textsearch_destroy(EM_TEXT_PRIV(m)->config);
 > 102			kfree(m->data);
   103		}
   104	}
   105	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
Re: [PATCH] net: sched: em_text: fix possible memory leak in em_text_destroy()
Posted by kernel test robot 1 year, 12 months ago 
Hi Hangyu,

kernel test robot noticed the following build warnings:

[auto build test WARNING on net-next/main]
[also build test WARNING on net/main linus/master v6.7-rc6]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Hangyu-Hua/net-sched-em_text-fix-possible-memory-leak-in-em_text_destroy/20231220-111317
base:   net-next/main
patch link:    https://lore.kernel.org/r/20231220030838.11751-1-hbh25y%40gmail.com
patch subject: [PATCH] net: sched: em_text: fix possible memory leak in em_text_destroy()
config: m68k-allmodconfig (https://download.01.org/0day-ci/archive/20231220/202312202228.58nFn5h0-lkp@intel.com/config)
compiler: m68k-linux-gcc (GCC) 13.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20231220/202312202228.58nFn5h0-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202312202228.58nFn5h0-lkp@intel.com/

All warnings (new ones prefixed by >>):

   net/sched/em_text.c: In function 'em_text_destroy':
>> net/sched/em_text.c:102:24: warning: passing argument 1 of 'kfree' makes pointer from integer without a cast [-Wint-conversion]
     102 |                 kfree(m->data);
         |                       ~^~~~~~
         |                        |
         |                        long unsigned int
   In file included from net/sched/em_text.c:8:
   include/linux/slab.h:227:24: note: expected 'const void *' but argument is of type 'long unsigned int'
     227 | void kfree(const void *objp);
         |            ~~~~~~~~~~~~^~~~


vim +/kfree +102 net/sched/em_text.c

    97	
    98	static void em_text_destroy(struct tcf_ematch *m)
    99	{
   100		if (EM_TEXT_PRIV(m) && EM_TEXT_PRIV(m)->config) {
   101			textsearch_destroy(EM_TEXT_PRIV(m)->config);
 > 102			kfree(m->data);
   103		}
   104	}
   105	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
Re: [PATCH] net: sched: em_text: fix possible memory leak in em_text_destroy()
Posted by Jamal Hadi Salim 1 year, 12 months ago 
Hi Hangyu,
While the fix looks correct - can you please describe how you came
across this issue? Was it a tool or by inspection? Do you have a text
case that triggered something etc, etc.

On Tue, Dec 19, 2023 at 10:09 PM Hangyu Hua <hbh25y@gmail.com> wrote:
>
> m->data needs to be freed when em_text_destroy is called.
>
> Fixes: d675c989ed2d ("[PKT_SCHED]: Packet classification based on textsearch (ematch)")
> Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
> ---
>  net/sched/em_text.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/net/sched/em_text.c b/net/sched/em_text.c
> index 6f3c1fb2fb44..b9d5d4dca2c9 100644
> --- a/net/sched/em_text.c
> +++ b/net/sched/em_text.c
> @@ -97,8 +97,10 @@ static int em_text_change(struct net *net, void *data, int len,
>
>  static void em_text_destroy(struct tcf_ematch *m)
>  {
> -       if (EM_TEXT_PRIV(m) && EM_TEXT_PRIV(m)->config)
> +       if (EM_TEXT_PRIV(m) && EM_TEXT_PRIV(m)->config) {
>                 textsearch_destroy(EM_TEXT_PRIV(m)->config);
> +               kfree(m->data);
> +       }
>  }
>

Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>

cheers,
jamal

>  static int em_text_dump(struct sk_buff *skb, struct tcf_ematch *m)
> --
> 2.34.1
>
Re: [PATCH] net: sched: em_text: fix possible memory leak in em_text_destroy()
Posted by Jamal Hadi Salim 1 year, 12 months ago 
On Wed, Dec 20, 2023 at 6:55 AM Jamal Hadi Salim <jhs@mojatatu.com> wrote:
>
> Hi Hangyu,
> While the fix looks correct - can you please describe how you came
> across this issue? Was it a tool or by inspection? Do you have a text
> case that triggered something etc, etc.
>
> On Tue, Dec 19, 2023 at 10:09 PM Hangyu Hua <hbh25y@gmail.com> wrote:
> >
> > m->data needs to be freed when em_text_destroy is called.
> >
> > Fixes: d675c989ed2d ("[PKT_SCHED]: Packet classification based on textsearch (ematch)")
> > Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
> > ---
> >  net/sched/em_text.c | 4 +++-
> >  1 file changed, 3 insertions(+), 1 deletion(-)
> >
> > diff --git a/net/sched/em_text.c b/net/sched/em_text.c
> > index 6f3c1fb2fb44..b9d5d4dca2c9 100644
> > --- a/net/sched/em_text.c
> > +++ b/net/sched/em_text.c
> > @@ -97,8 +97,10 @@ static int em_text_change(struct net *net, void *data, int len,
> >
> >  static void em_text_destroy(struct tcf_ematch *m)
> >  {
> > -       if (EM_TEXT_PRIV(m) && EM_TEXT_PRIV(m)->config)
> > +       if (EM_TEXT_PRIV(m) && EM_TEXT_PRIV(m)->config) {
> >                 textsearch_destroy(EM_TEXT_PRIV(m)->config);
> > +               kfree(m->data);
> > +       }
> >  }
> >
>

the bot just complained about needing a cast, use this:
struct text_match *

cheers,
jamal
> Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
>
> cheers,
> jamal
>
> >  static int em_text_dump(struct sk_buff *skb, struct tcf_ematch *m)
> > --
> > 2.34.1
> >
Re: [PATCH] net: sched: em_text: fix possible memory leak in em_text_destroy()
Posted by Hangyu Hua 1 year, 12 months ago 
On 21/12/2023 00:05, Jamal Hadi Salim wrote:
> On Wed, Dec 20, 2023 at 6:55 AM Jamal Hadi Salim <jhs@mojatatu.com> wrote:
>>
>> Hi Hangyu,
>> While the fix looks correct - can you please describe how you came
>> across this issue? Was it a tool or by inspection? Do you have a text
>> case that triggered something etc, etc.

I discovered this accidentally when I used gdb to debug a program that 
uses em_text. And I think putting the code in the commit log will will 
make it too bulky.

>>
>> On Tue, Dec 19, 2023 at 10:09 PM Hangyu Hua <hbh25y@gmail.com> wrote:
>>>
>>> m->data needs to be freed when em_text_destroy is called.
>>>
>>> Fixes: d675c989ed2d ("[PKT_SCHED]: Packet classification based on textsearch (ematch)")
>>> Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
>>> ---
>>>   net/sched/em_text.c | 4 +++-
>>>   1 file changed, 3 insertions(+), 1 deletion(-)
>>>
>>> diff --git a/net/sched/em_text.c b/net/sched/em_text.c
>>> index 6f3c1fb2fb44..b9d5d4dca2c9 100644
>>> --- a/net/sched/em_text.c
>>> +++ b/net/sched/em_text.c
>>> @@ -97,8 +97,10 @@ static int em_text_change(struct net *net, void *data, int len,
>>>
>>>   static void em_text_destroy(struct tcf_ematch *m)
>>>   {
>>> -       if (EM_TEXT_PRIV(m) && EM_TEXT_PRIV(m)->config)
>>> +       if (EM_TEXT_PRIV(m) && EM_TEXT_PRIV(m)->config) {
>>>                  textsearch_destroy(EM_TEXT_PRIV(m)->config);
>>> +               kfree(m->data);
>>> +       }
>>>   }
>>>
>>
> 
> the bot just complained about needing a cast, use this:
> struct text_match *

I see. I will send a v2 later.

Thanks,
Hangyu

> 
> cheers,
> jamal
>> Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
>>
>> cheers,
>> jamal
>>
>>>   static int em_text_dump(struct sk_buff *skb, struct tcf_ematch *m)
>>> --
>>> 2.34.1
>>>

Patchew 2.1-devel-b67e4c2

© 2016 - 2025 Red Hat, Inc.