Messages in this thread Patch in this message | | | Date | Thu, 24 Jun 2021 22:12:44 +0300 | From | Pavel Skripkin <> | Subject | Re: [syzbot] memory leak in xfrm_user_rcv_msg |
| |
On Tue, 22 Jun 2021 12:04:23 -0700 syzbot <syzbot+fb347cf82c73a90efcca@syzkaller.appspotmail.com> wrote:
> Hello, > > syzbot found the following issue on: > > HEAD commit: fd0aa1a4 Merge tag 'for-linus' of > git://git.kernel.org/pub.. git tree: upstream > console output: > https://syzkaller.appspot.com/x/log.txt?x=17464aa4300000 kernel > config: https://syzkaller.appspot.com/x/.config?x=6ec2526c74098317 > dashboard link: > https://syzkaller.appspot.com/bug?extid=fb347cf82c73a90efcca syz > repro: > https://syzkaller.appspot.com/x/repro.syz?x=14946548300000 C > reproducer: https://syzkaller.appspot.com/x/repro.c?x=10d28548300000 > > IMPORTANT: if you fix the issue, please add the following tag to the > commit: Reported-by: > syzbot+fb347cf82c73a90efcca@syzkaller.appspotmail.com >
#syz test git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
With regards, Pavel Skripkin From 6c124b1a50375215dcb6fae3f443a70340af1d47 Mon Sep 17 00:00:00 2001 From: Pavel Skripkin <paskripkin@gmail.com> Date: Thu, 24 Jun 2021 22:10:25 +0300 Subject: [PATCH] net: xfrm: fix memory leak in xfrm_user_rcv_msg
/* ...... */
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> --- net/xfrm/xfrm_user.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index f0aecee4d539..ff60ff804074 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -2811,6 +2811,16 @@ static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, err = link->doit(skb, nlh, attrs); + /* We need to free skb allocated in xfrm_alloc_compat() before + * returning from this function, because consume_skb() won't take + * care of frag_list since netlink destructor sets + * sbk->head to NULL. (see netlink_skb_destructor()) + */ + if (skb_has_frag_list(skb)) { + kfree_skb(skb_shinfo(skb)->frag_list); + skb_shinfo(skb)->frag_list = NULL; + } + err: kvfree(nlh64); return err; -- 2.32.0
| |