[PATCH] net: bridge: fix a memory leak in __vlan_add

After per-port vlan stats, vlan stats should be released
when fail to add vlan

Fixes: 9163a0fc1f0c0 ("net: bridge: add support for per-port vlan stats")
cc: Nikolay Aleksandrov <redacted>
Signed-off-by: Zhang Yu <redacted>
Signed-off-by: Li RongQing <redacted>
---
 net/bridge/br_vlan.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
index 9b707234e4ae..e08e269041dd 100644
--- a/net/bridge/br_vlan.c
+++ b/net/bridge/br_vlan.c

@@ -305,6 +305,10 @@ static int __vlan_add(struct net_bridge_vlan *v, u16 flags)
 		if (masterv) {
 			br_vlan_put_master(masterv);
 			v->brvlan = NULL;
+
+			if (masterv->stats != v->stats && v->stats)
+				free_percpu(v->stats);
+			v->stats = NULL;
 		}
 	} else {
 		br_switchdev_port_vlan_del(dev, v->vid);

-- 
2.16.2

On 14/10/2018 06:21, Li RongQing wrote:

Hi,
Good catch, but the patch doesn't fix the bug entirely. The problem is that masterv can be
created just for this vlan and the br_vlan_put_master() above can free it, so we can
check a pointer that's not really up-to-date (and thus again leak memory).
You should move the new code above the br_vlan_put_master() call.

Also please tag the proper branch, this is for net-next, and CC all bridge
maintainers (added Roopa).

Thank you,
 Nik

quoted

Hi,
Good catch, but the patch doesn't fix the bug entirely. The problem is that masterv can be
created just for this vlan and the br_vlan_put_master() above can free it, so we can
check a pointer that's not really up-to-date (and thus again leak memory).
You should move the new code above the br_vlan_put_master() call.

Also please tag the proper branch, this is for net-next, and CC all bridge
maintainers (added Roopa).

Ok, thanks, I will send v2

-RongQing

Thank you,
 Nik