From patchwork Tue Dec 20 21:27:17 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Aaron Conole X-Patchwork-Id: 35196 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:e747:0:0:0:0:0 with SMTP id c7csp3193435wrn; Tue, 20 Dec 2022 13:38:19 -0800 (PST) X-Google-Smtp-Source: AA0mqf65zzqhrMZeOzjohCesfiZWNohH+h+FEeD1f5si89bYkgmAghFH7Ud7GC8wCDLSqsh+3Jn/ X-Received: by 2002:a17:907:2985:b0:7c0:f907:89a2 with SMTP id eu5-20020a170907298500b007c0f90789a2mr32798845ejc.61.1671572299478; Tue, 20 Dec 2022 13:38:19 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1671572299; cv=none; d=google.com; s=arc-20160816; b=nTlOxBd/sCrtAoi1Hj6QyvzyHTneq3mFh6/DfroPZyvPVkGyFQUepErZCpHp+gepS9 drvM6+ih46HRJKt283TF3kFe0G1lzEAUNPeem3RkU3t2rSezdOwT+yA+PA41J3VtcG6L It9aQzgKU6Muca2EwAjl06Pns/4xpq8hAgpfPXgSjHs0DkeJTtSv/kSjQ9H+lxEcHYF3 0IgAZksfttTk5ZyWywjMNAJIn6ZuIZ5mSyXNucBV9IKpuv/hlKDermdGaytUwXK7kvzC sas76IZk2Tp1gNC3Qo0CIXq13GcThIdp7/6SUfyFDWPuDxbXTDxPrwHP3s6g65CWFwPG 5X7g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=CjIdiy7qWudpHRQwlyIrGgwMBBb8yFPp0r6JrGVeizM=; b=F1Vh3s4INaqI5pqqfnPbnNrLllJ1/fYarLYjD1A4RVVd8z2Nbsrl5galbVTq9whF+R 1DyI+lJOWVCIsnnOGu3l+yBxCigRyVQ7JOzlBVyLL8ttod1sg1nT38TDofKGjsczdy5I l5In0scm+nIyp2ob0jbvcFMAVs44dD7IsUXkv2SVA9w3wCRh1DQb9UvgPCkvVTJ2pyrq Gt8+VwKHXVduxKLtomXpOX/Y4F/g7O5/lnVF13/Z5Tc0nlMR61uRUxUEs/ssQGBIofhw pF0jrySA6dV9jrIIVR4R8qUuOpxremu8LZvk/9BUz4AUDO8KAsfQNbSGt1XkMO7Ti+DT e7pg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=NmPhOzAD; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id he11-20020a1709073d8b00b007c09bc6a8bfsi14098914ejc.250.2022.12.20.13.37.53; Tue, 20 Dec 2022 13:38:19 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=NmPhOzAD; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234122AbiLTV2O (ORCPT + 99 others); Tue, 20 Dec 2022 16:28:14 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49968 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233971AbiLTV2L (ORCPT ); Tue, 20 Dec 2022 16:28:11 -0500 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6CAF51EAE3 for ; Tue, 20 Dec 2022 13:27:24 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1671571643; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=CjIdiy7qWudpHRQwlyIrGgwMBBb8yFPp0r6JrGVeizM=; b=NmPhOzAD9kG5ed4ZkOq4b/EVs23lQNBYOsOk2EvIivzBVAgTqftvdIg/bOT/Esni4FG3Rb mitnZ/tgiFzyGLA+JncKxy/XO9l7uU56+R94TBtGg0NJohN5iVlN43/2Ju1Rft2FMegUU4 ryBaquioSE1jbX2xhHKvZD9LUIsJymI= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-217-TVK56jxcNsCi8i3ey1DOLA-1; Tue, 20 Dec 2022 16:27:20 -0500 X-MC-Unique: TVK56jxcNsCi8i3ey1DOLA-1 Received: from smtp.corp.redhat.com (int-mx10.intmail.prod.int.rdu2.redhat.com [10.11.54.10]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 3B0D3858F0E; Tue, 20 Dec 2022 21:27:18 +0000 (UTC) Received: from RHTPC1VM0NT.lan (unknown [10.22.32.165]) by smtp.corp.redhat.com (Postfix) with ESMTP id 9387D492B00; Tue, 20 Dec 2022 21:27:17 +0000 (UTC) From: Aaron Conole To: netdev@vger.kernel.org Cc: Pravin B Shelar , Jakub Kicinski , "David S. Miller" , Paolo Abeni , Eric Dumazet , Thomas Graf , dev@openvswitch.org, Eelco Chaudron , Ilya Maximets , wangchuanlei , linux-kernel@vger.kernel.org Subject: [PATCH net] net: openvswitch: release vport resources on failure Date: Tue, 20 Dec 2022 16:27:17 -0500 Message-Id: <20221220212717.526780-1-aconole@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.1 on 10.11.54.10 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1752770595302441459?= X-GMAIL-MSGID: =?utf-8?q?1752770595302441459?= A recent commit introducing upcall packet accounting failed to properly release the vport object when the per-cpu stats struct couldn't be allocated. This can cause dangling pointers to dp objects long after they've been released. Cc: Eelco Chaudron Cc: wangchuanlei Fixes: 1933ea365aa7 ("net: openvswitch: Add support to count upcall packets") Reported-by: syzbot+8f4e2dcfcb3209ac35f9@syzkaller.appspotmail.com Signed-off-by: Aaron Conole Acked-by: Eelco Chaudron Reviewed-by: Michal Swiatkowski --- net/openvswitch/datapath.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c index 932bcf766d63..6774baf9e212 100644 --- a/net/openvswitch/datapath.c +++ b/net/openvswitch/datapath.c @@ -1854,7 +1854,7 @@ static int ovs_dp_cmd_new(struct sk_buff *skb, struct genl_info *info) vport->upcall_stats = netdev_alloc_pcpu_stats(struct vport_upcall_stats_percpu); if (!vport->upcall_stats) { err = -ENOMEM; - goto err_destroy_portids; + goto err_destroy_vport; } err = ovs_dp_cmd_fill_info(dp, reply, info->snd_portid, @@ -1869,6 +1869,8 @@ static int ovs_dp_cmd_new(struct sk_buff *skb, struct genl_info *info) ovs_notify(&dp_datapath_genl_family, reply, info); return 0; +err_destroy_vport: + ovs_dp_detach_port(vport); err_destroy_portids: kfree(rcu_dereference_raw(dp->upcall_portids)); err_unlock_and_destroy_meters: @@ -2316,7 +2318,7 @@ static int ovs_vport_cmd_new(struct sk_buff *skb, struct genl_info *info) vport->upcall_stats = netdev_alloc_pcpu_stats(struct vport_upcall_stats_percpu); if (!vport->upcall_stats) { err = -ENOMEM; - goto exit_unlock_free; + goto exit_unlock_free_vport; } err = ovs_vport_cmd_fill_info(vport, reply, genl_info_net(info), @@ -2336,6 +2338,8 @@ static int ovs_vport_cmd_new(struct sk_buff *skb, struct genl_info *info) ovs_notify(&dp_vport_genl_family, reply, info); return 0; +exit_unlock_free_vport: + ovs_dp_detach_port(vport); exit_unlock_free: ovs_unlock(); kfree_skb(reply);