Messages in this thread | | | Date | Wed, 02 Nov 2022 08:05:00 -0700 | From | Kees Cook <> | Subject | Re: [PATCH net-next] netlink: Fix p otential skb memleak in netlink ack |
| |
On November 2, 2022 5:08:20 AM PDT, Tao Chen <chentao.kernel@linux.alibaba.com> wrote: >We should clean the skb resource if nlmsg_put/append failed >, so fix it. > >Fiexs: commit 738136a0e375 ("netlink: split up copies in the >ack construction") >Signed-off-by: Tao Chen <chentao.kernel@linux.alibaba.com> >--- > net/netlink/af_netlink.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > >diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c >index c6b8207e..9d73dae 100644 >--- a/net/netlink/af_netlink.c >+++ b/net/netlink/af_netlink.c >@@ -2500,7 +2500,7 @@ void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err, > > skb = nlmsg_new(payload + tlvlen, GFP_KERNEL); > if (!skb) >- goto err_bad_put; >+ goto err_skb; > > rep = nlmsg_put(skb, NETLINK_CB(in_skb).portid, nlh->nlmsg_seq, > NLMSG_ERROR, sizeof(*errmsg), flags); >@@ -2528,6 +2528,8 @@ void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err, > return; > > err_bad_put: >+ kfree_skb(skb); >+err_skb: > NETLINK_CB(in_skb).sk->sk_err = ENOBUFS; > sk_error_report(NETLINK_CB(in_skb).sk); > }
It didn't do this before... Is this right?
-- Kees Cook
| |