Daniel Borkmann
f4eaed28c7
act_bpf: fix memory leaks when replacing bpf programs ...
We currently trigger multiple memory leaks when replacing bpf
actions, besides others:
comm "tc", pid 1909, jiffies 4294851310 (age 1602.796s)
hex dump (first 32 bytes):
01 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 ................
18 b0 98 6d 00 88 ff ff 00 00 00 00 00 00 00 00 ...m............
backtrace:
[<ffffffff817e623e>] kmemleak_alloc+0x4e/0xb0
[<ffffffff8120a22d>] __vmalloc_node_range+0x1bd/0x2c0
[<ffffffff8120a37a>] __vmalloc+0x4a/0x50
[<ffffffff811a8d0a>] bpf_prog_alloc+0x3a/0xa0
[<ffffffff816c0684>] bpf_prog_create+0x44/0xa0
[<ffffffffa09ba4eb>] tcf_bpf_init+0x28b/0x3c0 [act_bpf]
[<ffffffff816d7001>] tcf_action_init_1+0x191/0x1b0
[<ffffffff816d70a2>] tcf_action_init+0x82/0xf0
[<ffffffff816d4d12>] tcf_exts_validate+0xb2/0xc0
[<ffffffffa09b5838>] cls_bpf_modify_existing+0x98/0x340 [cls_bpf]
[<ffffffffa09b5cd6>] cls_bpf_change+0x1a6/0x274 [cls_bpf]
[<ffffffff816d56e5>] tc_ctl_tfilter+0x335/0x910
[<ffffffff816b9145>] rtnetlink_rcv_msg+0x95/0x240
[<ffffffff816df34f>] netlink_rcv_skb+0xaf/0xc0
[<ffffffff816b909e>] rtnetlink_rcv+0x2e/0x40
[<ffffffff816deaaf>] netlink_unicast+0xef/0x1b0
Issue is that the old content from tcf_bpf is allocated and needs
to be released when we replace it. We seem to do that since the
beginning of act_bpf on the filter and insns, later on the name as
well.
Example test case, after patch:
# FOO="1,6 0 0 4294967295,"
# BAR="1,6 0 0 4294967294,"
# tc actions add action bpf bytecode "$FOO" index 2
# tc actions show action bpf
action order 0: bpf bytecode '1,6 0 0 4294967295' default-action pipe
index 2 ref 1 bind 0
# tc actions replace action bpf bytecode "$BAR" index 2
# tc actions show action bpf
action order 0: bpf bytecode '1,6 0 0 4294967294' default-action pipe
index 2 ref 1 bind 0
# tc actions replace action bpf bytecode "$FOO" index 2
# tc actions show action bpf
action order 0: bpf bytecode '1,6 0 0 4294967295' default-action pipe
index 2 ref 1 bind 0
# tc actions del action bpf index 2
[...]
# echo "scan" > /sys/kernel/debug/kmemleak
# cat /sys/kernel/debug/kmemleak | grep "comm \"tc\"" | wc -l
0
Fixes: d23b8ad8ab23 ("tc: add BPF based action")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-07-29 23:56:22 -07:00
2015-02-14 23:08:44 +01:00
2015-07-04 19:36:06 -07:00
2015-03-02 16:43:41 -05:00
2015-06-01 16:50:52 -07:00
2015-05-11 10:50:17 -04:00
2015-05-11 10:50:17 -04:00
2015-07-15 15:59:58 -07:00
2015-06-07 17:07:20 +02:00
2015-07-23 16:41:24 +02:00
2015-07-29 15:02:30 -07:00
2015-07-21 00:02:44 -07:00
2015-07-12 21:13:22 +02:00
2015-07-09 20:30:34 +03:00
2015-07-27 01:06:53 -07:00
2015-03-06 21:50:02 -05:00
2015-07-27 01:06:53 -07:00
2015-05-11 10:50:17 -04:00
2015-07-11 23:25:16 -07:00
2015-06-04 15:44:30 -07:00
2015-03-01 13:40:23 -05:00
2015-07-26 21:00:14 -07:00
2015-07-28 23:41:24 -07:00
2015-07-29 23:01:39 -07:00
2015-05-11 10:50:17 -04:00
2015-05-25 17:46:21 -04:00
2015-05-11 10:50:17 -04:00
2015-06-24 16:49:49 -07:00
2015-05-11 10:50:18 -04:00
2015-07-27 01:06:53 -07:00
2015-07-17 15:02:02 +02:00
2015-06-24 16:49:49 -07:00
2015-06-13 23:56:52 -07:00
2015-07-22 17:00:47 +02:00
2015-03-31 13:58:35 -04:00
2015-07-21 22:22:56 -07:00
2015-06-18 21:14:32 +02:00
2015-06-15 18:10:37 +02:00
2015-07-21 22:26:03 -07:00
2015-07-29 00:09:58 -07:00
2015-05-11 10:50:17 -04:00
2015-07-15 17:03:03 -07:00
2015-05-29 13:13:45 +02:00
2015-06-24 02:58:51 -07:00
2015-05-11 10:50:17 -04:00
2015-07-29 23:56:22 -07:00
2015-07-26 16:32:41 -07:00
2015-07-02 11:32:23 -07:00
2015-07-11 21:29:55 -07:00
2015-07-08 16:08:23 -07:00
2015-06-10 22:49:20 -07:00
2015-05-11 10:50:17 -04:00
2015-07-17 15:02:02 +02:00
2015-05-11 10:50:17 -04:00
2015-06-24 16:49:49 -07:00
2015-04-09 00:02:26 -04:00
2015-05-14 01:10:05 -04:00
2015-03-04 00:26:06 -05:00
2015-05-11 10:50:17 -04:00
f4eaed28c7