| Message ID | 20210804070329.1357123-2-steffen.klassert@secunet.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 7c1a80e80cde008f271bae630d28cf684351e807 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [1/6] net: xfrm: fix memory leak in xfrm_user_rcv_msg | expand |
| Context | Check | Description |
|---|---|---|
| netdev/cover_letter | success | Pull request |
| netdev/fixes_present | success | Link |
| netdev/patch_count | success | Link |
| netdev/tree_selection | success | Guessed tree name to be net-next |
| netdev/subject_prefix | warning | Target tree name not specified in the subject |
| netdev/cc_maintainers | fail | 1 blamed authors not CCed: 0x7f454c46@gmail.com; 1 maintainers not CCed: 0x7f454c46@gmail.com |
| netdev/source_inline | success | Was 0 now: 0 |
| netdev/verify_signedoff | success | Link |
| netdev/module_param | success | Was 0 now: 0 |
| netdev/build_32bit | success | Errors and warnings before: 14 this patch: 14 |
| netdev/kdoc | success | Errors and warnings before: 0 this patch: 0 |
| netdev/verify_fixes | success | Link |
| netdev/checkpatch | success | total: 0 errors, 0 warnings, 0 checks, 16 lines checked |
| netdev/build_allmodconfig_warn | success | Errors and warnings before: 14 this patch: 14 |
| netdev/header_inline | success | Link |
Hello: This series was applied to netdev/net.git (refs/heads/master): On Wed, 4 Aug 2021 09:03:24 +0200 you wrote: > From: Pavel Skripkin <paskripkin@gmail.com> > > Syzbot reported memory leak in xfrm_user_rcv_msg(). The > problem was is non-freed skb's frag_list. > > In skb_release_all() skb_release_data() will be called only > in case of skb->head != NULL, but netlink_skb_destructor() > sets head to NULL. So, allocated frag_list skb should be > freed manualy, since consume_skb() won't take care of it > > [...] Here is the summary with links: - [1/6] net: xfrm: fix memory leak in xfrm_user_rcv_msg https://git.kernel.org/netdev/net/c/7c1a80e80cde - [2/6] Revert "xfrm: policy: Read seqcount outside of rcu-read side in xfrm_policy_lookup_bytype" https://git.kernel.org/netdev/net/c/eaf228263921 - [3/6] xfrm: Fix RCU vs hash_resize_mutex lock inversion https://git.kernel.org/netdev/net/c/2580d3f40022 - [4/6] net/xfrm/compat: Copy xfrm_spdattr_type_t atributes https://git.kernel.org/netdev/net/c/4e9505064f58 - [5/6] selftests/net/ipsec: Add test for xfrm_spdattr_type_t https://git.kernel.org/netdev/net/c/70bfdf62e93a - [6/6] net: xfrm: Fix end of loop tests for list_for_each_entry https://git.kernel.org/netdev/net/c/480e93e12aa0 You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index b47d613409b7..7aff641c717d 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -2811,6 +2811,16 @@ static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, err = link->doit(skb, nlh, attrs); + /* We need to free skb allocated in xfrm_alloc_compat() before + * returning from this function, because consume_skb() won't take + * care of frag_list since netlink destructor sets + * sbk->head to NULL. (see netlink_skb_destructor()) + */ + if (skb_has_frag_list(skb)) { + kfree_skb(skb_shinfo(skb)->frag_list); + skb_shinfo(skb)->frag_list = NULL; + } + err: kvfree(nlh64); return err;