lkml.org 
[lkml]   [2021]   [Jun]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: [syzbot] memory leak in xfrm_user_rcv_msg
On Tue, 22 Jun 2021 12:04:23 -0700
syzbot <syzbot+fb347cf82c73a90efcca@syzkaller.appspotmail.com> wrote:

> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: fd0aa1a4 Merge tag 'for-linus' of
> git://git.kernel.org/pub.. git tree: upstream
> console output:
> https://syzkaller.appspot.com/x/log.txt?x=17464aa4300000 kernel
> config: https://syzkaller.appspot.com/x/.config?x=6ec2526c74098317
> dashboard link:
> https://syzkaller.appspot.com/bug?extid=fb347cf82c73a90efcca syz
> repro:
> https://syzkaller.appspot.com/x/repro.syz?x=14946548300000 C
> reproducer: https://syzkaller.appspot.com/x/repro.c?x=10d28548300000
>
> IMPORTANT: if you fix the issue, please add the following tag to the
> commit: Reported-by:
> syzbot+fb347cf82c73a90efcca@syzkaller.appspotmail.com
>


#syz test
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master


With regards,
Pavel Skripkin
From 6c124b1a50375215dcb6fae3f443a70340af1d47 Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Thu, 24 Jun 2021 22:10:25 +0300
Subject: [PATCH] net: xfrm: fix memory leak in xfrm_user_rcv_msg

/* ...... */

Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
---
net/xfrm/xfrm_user.c | 10 ++++++++++
1 file changed, 10 insertions(+)

diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index f0aecee4d539..ff60ff804074 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -2811,6 +2811,16 @@ static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,

err = link->doit(skb, nlh, attrs);

+ /* We need to free skb allocated in xfrm_alloc_compat() before
+ * returning from this function, because consume_skb() won't take
+ * care of frag_list since netlink destructor sets
+ * sbk->head to NULL. (see netlink_skb_destructor())
+ */
+ if (skb_has_frag_list(skb)) {
+ kfree_skb(skb_shinfo(skb)->frag_list);
+ skb_shinfo(skb)->frag_list = NULL;
+ }
+
err:
kvfree(nlh64);
return err;
--
2.32.0
\
 
 \ /
  Last update: 2021-06-24 21:13    [W:0.155 / U:0.008 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site