On Tue, Aug 09, 2022 at 07:02:45PM +0300, Viacheslav Sablin wrote: > From: Ahmed Zaki <anzaki@xxxxxxxxx> > > commit 8f9dcc29566626f683843ccac6113a12208315ca upstream. > > The following is from a system that went OOM due to a memory leak: > > wlan0: Allocated STA 74:83:c2:64:0b:87 > wlan0: Allocated STA 74:83:c2:64:0b:87 > wlan0: IBSS finish 74:83:c2:64:0b:87 (---from ieee80211_ibss_add_sta) > wlan0: Adding new IBSS station 74:83:c2:64:0b:87 > wlan0: moving STA 74:83:c2:64:0b:87 to state 2 > wlan0: moving STA 74:83:c2:64:0b:87 to state 3 > wlan0: Inserted STA 74:83:c2:64:0b:87 > wlan0: IBSS finish 74:83:c2:64:0b:87 (---from ieee80211_ibss_work) > wlan0: Adding new IBSS station 74:83:c2:64:0b:87 > wlan0: moving STA 74:83:c2:64:0b:87 to state 2 > wlan0: moving STA 74:83:c2:64:0b:87 to state 3 > . > . > wlan0: expiring inactive not authorized STA 74:83:c2:64:0b:87 > wlan0: moving STA 74:83:c2:64:0b:87 to state 2 > wlan0: moving STA 74:83:c2:64:0b:87 to state 1 > wlan0: Removed STA 74:83:c2:64:0b:87 > wlan0: Destroyed STA 74:83:c2:64:0b:87 > > The ieee80211_ibss_finish_sta() is called twice on the same STA from 2 > different locations. On the second attempt, the allocated STA is not > destroyed creating a kernel memory leak. > > This is happening because sta_info_insert_finish() does not call > sta_info_free() the second time when the STA already exists (returns > -EEXIST). Note that the caller sta_info_insert_rcu() assumes STA is > destroyed upon errors. > > Same fix is applied to -ENOMEM. > > Signed-off-by: Ahmed Zaki <anzaki@xxxxxxxxx> > Link: https://lore.kernel.org/r/20211002145329.3125293-1-anzaki@xxxxxxxxx > [change the error path label to use the existing code] > Signed-off-by: Johannes Berg <johannes.berg@xxxxxxxxx> > Signed-off-by: Viacheslav Sablin <sablin@xxxxxxxxx> > --- > net/mac80211/sta_info.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) This is also needed in 5.15.y, so added there as well. thanks, greg k-h
