ieee802154: hwsim: Fix memory leak in hwsim_add_one
authorDongliang Mu <mudongliangabcd@gmail.com>
Wed, 16 Jun 2021 02:09:01 +0000 (10:09 +0800)
committerStefan Schmidt <stefan@datenfreihafen.org>
Tue, 22 Jun 2021 19:09:53 +0000 (21:09 +0200)
commit28a5501c3383f0e6643012c187b7c2027ef42aea
tree0196285db8eef1a31a6c117be5c5fa8a8f87389a
parentab372c2293f5d0b279f31c8d768566ea37602dc9
ieee802154: hwsim: Fix memory leak in hwsim_add_one

No matter from hwsim_remove or hwsim_del_radio_nl, hwsim_del fails to
remove the entry in the edges list. Take the example below, phy0, phy1
and e0 will be deleted, resulting in e1 not freed and accessed in the
future.

              hwsim_phys
                  |
    ------------------------------
    |                            |
phy0 (edges)                 phy1 (edges)
   ----> e1 (idx = 1)             ----> e0 (idx = 0)

Fix this by deleting and freeing all the entries in the edges list
between hwsim_edge_unsubscribe_me and list_del(&phy->list).

Reported-by: syzbot+b80c9959009a9325cdff@syzkaller.appspotmail.com
Fixes: 1c9f4a3fce77 ("ieee802154: hwsim: fix rcu handling")
Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
Acked-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210616020901.2759466-1-mudongliangabcd@gmail.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
drivers/net/ieee802154/mac802154_hwsim.c