lkml.org 
[lkml]   [2022]   [Aug]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 141/244] net: genl: fix error path memory leak in policy dumping
    Date
    From: Jakub Kicinski <kuba@kernel.org>

    commit 249801360db3dec4f73768c502192020bfddeacc upstream.

    If construction of the array of policies fails when recording
    non-first policy we need to unwind.

    netlink_policy_dump_add_policy() itself also needs fixing as
    it currently gives up on error without recording the allocated
    pointer in the pstate pointer.

    Reported-by: syzbot+dc54d9ba8153b216cae0@syzkaller.appspotmail.com
    Fixes: 50a896cf2d6f ("genetlink: properly support per-op policy dumping")
    Link: https://lore.kernel.org/r/20220816161939.577583-1-kuba@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/netlink/genetlink.c | 6 +++++-
    net/netlink/policy.c | 14 ++++++++++++--
    2 files changed, 17 insertions(+), 3 deletions(-)

    --- a/net/netlink/genetlink.c
    +++ b/net/netlink/genetlink.c
    @@ -1174,13 +1174,17 @@ static int ctrl_dumppolicy_start(struct
    op.policy,
    op.maxattr);
    if (err)
    - return err;
    + goto err_free_state;
    }
    }

    if (!ctx->state)
    return -ENODATA;
    return 0;
    +
    +err_free_state:
    + netlink_policy_dump_free(ctx->state);
    + return err;
    }

    static void *ctrl_dumppolicy_prep(struct sk_buff *skb,
    --- a/net/netlink/policy.c
    +++ b/net/netlink/policy.c
    @@ -144,7 +144,7 @@ int netlink_policy_dump_add_policy(struc

    err = add_policy(&state, policy, maxtype);
    if (err)
    - return err;
    + goto err_try_undo;

    for (policy_idx = 0;
    policy_idx < state->n_alloc && state->policies[policy_idx].policy;
    @@ -164,7 +164,7 @@ int netlink_policy_dump_add_policy(struc
    policy[type].nested_policy,
    policy[type].len);
    if (err)
    - return err;
    + goto err_try_undo;
    break;
    default:
    break;
    @@ -174,6 +174,16 @@ int netlink_policy_dump_add_policy(struc

    *pstate = state;
    return 0;
    +
    +err_try_undo:
    + /* Try to preserve reasonable unwind semantics - if we're starting from
    + * scratch clean up fully, otherwise record what we got and caller will.
    + */
    + if (!*pstate)
    + netlink_policy_dump_free(state);
    + else
    + *pstate = state;
    + return err;
    }

    static bool

    \
     
     \ /
      Last update: 2022-08-23 12:17    [W:4.201 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site