Skip to content
Commit 28a5501c authored by Dongliang Mu's avatar Dongliang Mu Committed by Stefan Schmidt
Browse files

ieee802154: hwsim: Fix memory leak in hwsim_add_one



No matter from hwsim_remove or hwsim_del_radio_nl, hwsim_del fails to
remove the entry in the edges list. Take the example below, phy0, phy1
and e0 will be deleted, resulting in e1 not freed and accessed in the
future.

              hwsim_phys
                  |
    ------------------------------
    |                            |
phy0 (edges)                 phy1 (edges)
   ----> e1 (idx = 1)             ----> e0 (idx = 0)

Fix this by deleting and freeing all the entries in the edges list
between hwsim_edge_unsubscribe_me and list_del(&phy->list).

Reported-by: default avatar <syzbot+b80c9959009a9325cdff@syzkaller.appspotmail.com>
Fixes: 1c9f4a3f

 ("ieee802154: hwsim: fix rcu handling")
Signed-off-by: default avatarDongliang Mu <mudongliangabcd@gmail.com>
Acked-by: default avatarAlexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210616020901.2759466-1-mudongliangabcd@gmail.com
Signed-off-by: default avatarStefan Schmidt <stefan@datenfreihafen.org>
parent ab372c22
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment