Messages in this thread Patch in this message | | | Date | Fri, 12 Aug 2022 14:04:39 -0700 | From | Jakub Kicinski <> | Subject | Re: [syzbot] memory leak in netlink_policy_dump_add_policy |
| |
On Fri, 12 Aug 2022 10:04:26 -0700 syzbot wrote: > Hello, > > syzbot found the following issue on: > > HEAD commit: 4e23eeebb2e5 Merge tag 'bitmap-6.0-rc1' of https://github... > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=165f4f6a080000 > kernel config: https://syzkaller.appspot.com/x/.config?x=3a433c7a2539f51c > dashboard link: https://syzkaller.appspot.com/bug?extid=dc54d9ba8153b216cae0 > compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1443be71080000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11e5918e080000 > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > Reported-by: syzbot+dc54d9ba8153b216cae0@syzkaller.appspotmail.com
Let's see if attaching a patch works...
#syz test From 7b3f410d5c49568deffcc8ee9881a7d3de730699 Mon Sep 17 00:00:00 2001 From: Jakub Kicinski <kuba@kernel.org> Date: Fri, 12 Aug 2022 13:56:48 -0700 Subject: [--remember tree name--] net: genl: fix error path memory leak in policy dumping
If construction of the array of policies fails when recording non-first policy we need to unwind.
Reported-by: syzbot+dc54d9ba8153b216cae0@syzkaller.appspotmail.com Fixes: 50a896cf2d6f ("genetlink: properly support per-op policy dumping") Signed-off-by: Jakub Kicinski <kuba@kernel.org> --- net/netlink/genetlink.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c index 1afca2a6c2ac..57010927e20a 100644 --- a/net/netlink/genetlink.c +++ b/net/netlink/genetlink.c @@ -1174,13 +1174,17 @@ static int ctrl_dumppolicy_start(struct netlink_callback *cb) op.policy, op.maxattr); if (err) - return err; + goto err_free_state; } } if (!ctx->state) return -ENODATA; return 0; + +err_free_state: + netlink_policy_dump_free(ctx->state); + return err; } static void *ctrl_dumppolicy_prep(struct sk_buff *skb, -- 2.37.1
| |