64453d60e6
commit 421d467dc2d483175bad4fb76a31b9e5a3d744cf upstream.
When batadv_v_ogm_aggr_send is called for an inactive interface, the skb
is silently dropped by batadv_v_ogm_send_to_if() but never freed causing
the following memory leak:
unreferenced object 0xffff00000c164800 (size 512):
comm "kworker/u8:1", pid 2648, jiffies 4295122303 (age 97.656s)
hex dump (first 32 bytes):
00 80 af 09 00 00 ff ff e1 09 00 00 75 01 60 83 ............u.`.
1f 00 00 00 b8 00 00 00 15 00 05 00 da e3 d3 64 ...............d
backtrace:
[<0000000007ad20f6>] __kmalloc_track_caller+0x1a8/0x310
[<00000000d1029e55>] kmalloc_reserve.constprop.0+0x70/0x13c
[<000000008b9d4183>] __alloc_skb+0xec/0x1fc
[<00000000c7af5051>] __netdev_alloc_skb+0x48/0x23c
[<00000000642ee5f5>] batadv_v_ogm_aggr_send+0x50/0x36c
[<0000000088660bd7>] batadv_v_ogm_aggr_work+0x24/0x40
[<0000000042fc2606>] process_one_work+0x3b0/0x610
[<000000002f2a0b1c>] worker_thread+0xa0/0x690
[<0000000059fae5d4>] kthread+0x1fc/0x210
[<000000000c587d3a>] ret_from_fork+0x10/0x20
Free the skb in that case to fix this leak.
Cc: stable@vger.kernel.org
Fixes:
|
||
---|---|---|
.. | ||
bat_algo.c | ||
bat_algo.h | ||
bat_iv_ogm.c | ||
bat_iv_ogm.h | ||
bat_v.c | ||
bat_v.h | ||
bat_v_elp.c | ||
bat_v_elp.h | ||
bat_v_ogm.c | ||
bat_v_ogm.h | ||
bitarray.c | ||
bitarray.h | ||
bridge_loop_avoidance.c | ||
bridge_loop_avoidance.h | ||
debugfs.c | ||
debugfs.h | ||
distributed-arp-table.c | ||
distributed-arp-table.h | ||
fragmentation.c | ||
fragmentation.h | ||
gateway_client.c | ||
gateway_client.h | ||
gateway_common.c | ||
gateway_common.h | ||
hard-interface.c | ||
hard-interface.h | ||
hash.c | ||
hash.h | ||
icmp_socket.c | ||
icmp_socket.h | ||
Kconfig | ||
log.c | ||
log.h | ||
main.c | ||
main.h | ||
Makefile | ||
multicast.c | ||
multicast.h | ||
netlink.c | ||
netlink.h | ||
network-coding.c | ||
network-coding.h | ||
originator.c | ||
originator.h | ||
routing.c | ||
routing.h | ||
send.c | ||
send.h | ||
soft-interface.c | ||
soft-interface.h | ||
sysfs.c | ||
sysfs.h | ||
tp_meter.c | ||
tp_meter.h | ||
translation-table.c | ||
translation-table.h | ||
tvlv.c | ||
tvlv.h | ||
types.h |