|
 |
3dfa50 |
From 9b0389837d7532909a8070d5a08f0175c367c12e Mon Sep 17 00:00:00 2001
|
|
|
3dfa50 |
From: Chris Leech <cleech@redhat.com>
|
|
|
3dfa50 |
Date: Wed, 23 May 2018 16:37:51 -0700
|
|
|
3dfa50 |
Subject: [PATCH] memleak on received TLVs from modules
|
|
|
3dfa50 |
|
|
|
3dfa50 |
Most of the TLV modules that have an rchange handler for received TLVs
|
|
|
3dfa50 |
seem to get the return values wrong, returning 0 or TLV_OK without
|
|
|
3dfa50 |
freeing or storing the unpacked TLV to be freed later. That leaks the
|
|
|
3dfa50 |
allocation, as rxProcessFrame believes the module has claimed ownership.
|
|
|
3dfa50 |
|
|
|
3dfa50 |
In a test setup, it's probably easiest to see by enabling some TLV type
|
|
|
3dfa50 |
on one side of a connection only. Or, any unexpected TLV that doesn't
|
|
|
3dfa50 |
get handled will be erroneously leaked by the EVB modules.
|
|
|
3dfa50 |
---
|
|
|
3dfa50 |
lldp_8021qaz.c | 4 ++--
|
|
|
3dfa50 |
lldp_evb.c | 8 +++++---
|
|
|
3dfa50 |
lldp_evb22.c | 8 +++++---
|
|
|
3dfa50 |
3 files changed, 12 insertions(+), 8 deletions(-)
|
|
|
3dfa50 |
|
|
|
3dfa50 |
diff --git a/lldp_8021qaz.c b/lldp_8021qaz.c
|
|
|
3dfa50 |
index 094676d..198ebcf 100644
|
|
|
3dfa50 |
--- a/lldp_8021qaz.c
|
|
|
3dfa50 |
+++ b/lldp_8021qaz.c
|
|
|
3dfa50 |
@@ -1924,7 +1924,7 @@ int ieee8021qaz_rchange(struct port *port, struct lldp_agent *agent,
|
|
|
3dfa50 |
struct ieee8021qaz_unpkd_tlvs *rx;
|
|
|
3dfa50 |
|
|
|
3dfa50 |
if (agent->type != NEAREST_BRIDGE)
|
|
|
3dfa50 |
- return 0;
|
|
|
3dfa50 |
+ return SUBTYPE_INVALID;
|
|
|
3dfa50 |
|
|
|
3dfa50 |
qaz_tlvs = ieee8021qaz_data(port->ifname);
|
|
|
3dfa50 |
if (!qaz_tlvs)
|
|
|
3dfa50 |
@@ -2005,7 +2005,7 @@ int ieee8021qaz_rchange(struct port *port, struct lldp_agent *agent,
|
|
|
3dfa50 |
}
|
|
|
3dfa50 |
}
|
|
|
3dfa50 |
|
|
|
3dfa50 |
- return TLV_OK;
|
|
|
3dfa50 |
+ return SUBTYPE_INVALID;
|
|
|
3dfa50 |
}
|
|
|
3dfa50 |
|
|
|
3dfa50 |
static void ieee8021qaz_free_rx(struct ieee8021qaz_unpkd_tlvs *rx)
|
|
|
3dfa50 |
diff --git a/lldp_evb.c b/lldp_evb.c
|
|
|
3dfa50 |
index 4b3752e..07f5ffb 100644
|
|
|
3dfa50 |
--- a/lldp_evb.c
|
|
|
3dfa50 |
+++ b/lldp_evb.c
|
|
|
3dfa50 |
@@ -210,7 +210,8 @@ static int evb_rchange(struct port *port, struct lldp_agent *agent,
|
|
|
3dfa50 |
u8 oui_subtype[OUI_SUB_SIZE] = LLDP_OUI_SUBTYPE;
|
|
|
3dfa50 |
|
|
|
3dfa50 |
if (agent->type != NEAREST_CUSTOMER_BRIDGE)
|
|
|
3dfa50 |
- return 0;
|
|
|
3dfa50 |
+ return SUBTYPE_INVALID;
|
|
|
3dfa50 |
+
|
|
|
3dfa50 |
ed = evb_data(port->ifname, agent->type);
|
|
|
3dfa50 |
|
|
|
3dfa50 |
if (!ed)
|
|
|
3dfa50 |
@@ -229,7 +230,7 @@ static int evb_rchange(struct port *port, struct lldp_agent *agent,
|
|
|
3dfa50 |
if (!ed->txmit) {
|
|
|
3dfa50 |
LLDPAD_WARN("%s:%s agent %d EVB Config disabled\n",
|
|
|
3dfa50 |
__func__, ed->ifname, agent->type);
|
|
|
3dfa50 |
- return TLV_OK;
|
|
|
3dfa50 |
+ return SUBTYPE_INVALID;
|
|
|
3dfa50 |
}
|
|
|
3dfa50 |
|
|
|
3dfa50 |
LLDPAD_DBG("%s:%s agent %d received tlv:\n", __func__,
|
|
|
3dfa50 |
@@ -246,7 +247,8 @@ static int evb_rchange(struct port *port, struct lldp_agent *agent,
|
|
|
3dfa50 |
evb_print_tlvinfo(ed->ifname, &ed->tie);
|
|
|
3dfa50 |
vdp_update(port->ifname, ed->tie.ccap);
|
|
|
3dfa50 |
}
|
|
|
3dfa50 |
- return TLV_OK;
|
|
|
3dfa50 |
+
|
|
|
3dfa50 |
+ return SUBTYPE_INVALID;
|
|
|
3dfa50 |
}
|
|
|
3dfa50 |
|
|
|
3dfa50 |
/*
|
|
|
3dfa50 |
diff --git a/lldp_evb22.c b/lldp_evb22.c
|
|
|
3dfa50 |
index 85c6abc..64b04e0 100644
|
|
|
3dfa50 |
--- a/lldp_evb22.c
|
|
|
3dfa50 |
+++ b/lldp_evb22.c
|
|
|
3dfa50 |
@@ -305,7 +305,8 @@ static int evb22_rchange(struct port *port, struct lldp_agent *agent,
|
|
|
3dfa50 |
u8 oui_subtype[OUI_SUB_SIZE] = LLDP_MOD_EVB22_OUI;
|
|
|
3dfa50 |
|
|
|
3dfa50 |
if (agent->type != NEAREST_CUSTOMER_BRIDGE)
|
|
|
3dfa50 |
- return 0;
|
|
|
3dfa50 |
+ return SUBTYPE_INVALID;
|
|
|
3dfa50 |
+
|
|
|
3dfa50 |
ed = evb22_data(port->ifname, agent->type);
|
|
|
3dfa50 |
|
|
|
3dfa50 |
if (!ed)
|
|
|
3dfa50 |
@@ -324,7 +325,7 @@ static int evb22_rchange(struct port *port, struct lldp_agent *agent,
|
|
|
3dfa50 |
if (!ed->txmit) {
|
|
|
3dfa50 |
LLDPAD_WARN("%s:%s agent %d EVB Config disabled\n",
|
|
|
3dfa50 |
__func__, ed->ifname, agent->type);
|
|
|
3dfa50 |
- return TLV_OK;
|
|
|
3dfa50 |
+ return SUBTYPE_INVALID;
|
|
|
3dfa50 |
}
|
|
|
3dfa50 |
|
|
|
3dfa50 |
LLDPAD_DBG("%s:%s agent %d received tlv:\n", __func__,
|
|
|
3dfa50 |
@@ -341,7 +342,8 @@ static int evb22_rchange(struct port *port, struct lldp_agent *agent,
|
|
|
3dfa50 |
evb22_print_tlvinfo(ed->ifname, &ed->out);
|
|
|
3dfa50 |
/* TODO vdp_update(port->ifname, ed->tie.ccap); */
|
|
|
3dfa50 |
}
|
|
|
3dfa50 |
- return TLV_OK;
|
|
|
3dfa50 |
+
|
|
|
3dfa50 |
+ return SUBTYPE_INVALID;
|
|
|
3dfa50 |
}
|
|
|
3dfa50 |
|
|
|
3dfa50 |
/*
|
|
|
3dfa50 |
--
|
|
|
3dfa50 |
2.19.1
|