lkml.org 
[lkml]   [2023]   [Dec]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
SubjectRe: [syzbot] [arm-msm?] [net?] memory leak in radix_tree_insert
From
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: [arm-msm?] [net?] memory leak in radix_tree_insert
Author: eadavis@qq.com

please test memory leak in radix_tree_insert

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 33cc938e65a9

diff --git a/net/qrtr/af_qrtr.c b/net/qrtr/af_qrtr.c
index 41ece61eb57a..3d06156fe913 100644
--- a/net/qrtr/af_qrtr.c
+++ b/net/qrtr/af_qrtr.c
@@ -275,6 +275,8 @@ static int qrtr_tx_wait(struct qrtr_node *node, int dest_node, int dest_port,
if (flow) {
init_waitqueue_head(&flow->resume_tx);
if (radix_tree_insert(&node->qrtr_tx_flow, key, flow)) {
+ printk("f: %p\n", flow);
+ radix_tree_delete(&node->qrtr_tx_flow, key);
kfree(flow);
flow = NULL;
}
@@ -287,10 +289,14 @@ static int qrtr_tx_wait(struct qrtr_node *node, int dest_node, int dest_port,
return 1;

spin_lock_irq(&flow->resume_tx.lock);
+ printk("to wait, f: %p, pd: %d, ff: %d, ep: %p\n",
+ flow, flow->pending, flow->failed, node->ep);
ret = wait_event_interruptible_locked_irq(flow->resume_tx,
flow->pending < QRTR_TX_FLOW_HIGH ||
flow->tx_failed ||
!node->ep);
+ printk("r: %d, f: %p, pd: %d, ff: %d, ep: %p\n",
+ ret, flow, flow->pending, flow->failed, node->ep);
if (ret < 0) {
confirm_rx = ret;
} else if (!node->ep) {
@@ -911,6 +917,9 @@ static int qrtr_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
u32 type;
int rc;

+ if (!msg->msg_iter.count)
+ return -EINVAL;
+
if (msg->msg_flags & ~(MSG_DONTWAIT))
return -EINVAL;

\
 
 \ /
  Last update: 2023-12-09 07:54    [W:0.118 / U:2.444 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site