[12/39] do_mq_notify(): saner skb freeing on failures

Message ID	20240730051625.14349-12-viro@kernel.org (mailing list archive)
State	Not Applicable
Headers	show Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 70285192B87; Tue, 30 Jul 2024 05:14:58 +0000 (UTC) From: viro@kernel.org To: linux-fsdevel@vger.kernel.org Cc: amir73il@gmail.com, bpf@vger.kernel.org, brauner@kernel.org, cgroups@vger.kernel.org, kvm@vger.kernel.org, netdev@vger.kernel.org, torvalds@linux-foundation.org Subject: [PATCH 12/39] do_mq_notify(): saner skb freeing on failures Date: Tue, 30 Jul 2024 01:15:58 -0400 Message-Id: <20240730051625.14349-12-viro@kernel.org> In-Reply-To: <20240730051625.14349-1-viro@kernel.org> References: <20240730050927.GC5334@ZenIV> <20240730051625.14349-1-viro@kernel.org> Precedence: bulk MIME-Version: 1.0 Content-Transfer-Encoding: 8bit
Series	[01/39] memcg_write_event_control(): fix a user-triggerable oops \| expand [01/39] memcg_write_event_control(): fix a user-triggerable oops [02/39] introduce fd_file(), convert all accessors to it. [03/39] struct fd: representation change [04/39] add struct fd constructors, get rid of __to_fd() [05/39] regularize emptiness checks in fini_module(2) and vfs_dedupe_file_range() [06/39] net/socket.c: switch to CLASS(fd) [07/39] introduce struct fderr, convert overlayfs uses to that [08/39] experimental: convert fs/overlayfs/file.c to CLASS(...) [09/39] timerfd: switch to CLASS(fd, ...) [10/39] get rid of perf_fget_light(), convert kernel/events/core.c to CLASS(fd) [11/39] switch netlink_getsockbyfilp() to taking descriptor [12/39] do_mq_notify(): saner skb freeing on failures [13/39] do_mq_notify(): switch to CLASS(fd, ...) [14/39] simplify xfs_find_handle() a bit [15/39] convert vmsplice() to CLASS(fd, ...) [16/39] convert __bpf_prog_get() to CLASS(fd, ...) [17/39] bpf: resolve_pseudo_ldimm64(): take handling of a single ldimm64 insn into helper [18/39] bpf maps: switch to CLASS(fd, ...) [19/39] fdget_raw() users: switch to CLASS(fd_raw, ...) [20/39] introduce "fd_pos" class, convert fdget_pos() users to it. [21/39] o2hb_region_dev_store(): avoid goto around fdget()/fdput() [22/39] privcmd_ioeventfd_assign(): don't open-code eventfd_ctx_fdget() [23/39] fdget(), trivial conversions [24/39] fdget(), more trivial conversions [25/39] convert do_preadv()/do_pwritev() [26/39] convert cachestat(2) [27/39] switch spufs_calls_{get,put}() to CLASS() use [28/39] convert spu_run(2) [29/39] convert media_request_get_by_fd() [30/39] convert coda_parse_fd() [31/39] convert cifs_ioctl_copychunk() [32/39] convert vfs_dedupe_file_range(). [33/39] convert do_select() [34/39] do_pollfd(): convert to CLASS(fd) [35/39] convert bpf_token_create() [36/39] assorted variants of irqfd setup: convert to CLASS(fd) [37/39] memcg_write_event_control(): switch to CLASS(fd) [38/39] css_set_fork(): switch to CLASS(fd_raw, ...) [39/39] deal with the last remaing boolean uses of fd_file()

Message ID

20240730051625.14349-12-viro@kernel.org (mailing list archive)

State

Not Applicable

Headers

From: viro@kernel.org
To: linux-fsdevel@vger.kernel.org
Cc: amir73il@gmail.com,
	bpf@vger.kernel.org,
	brauner@kernel.org,
	cgroups@vger.kernel.org,
	kvm@vger.kernel.org,
	netdev@vger.kernel.org,
	torvalds@linux-foundation.org
Subject: [PATCH 12/39] do_mq_notify(): saner skb freeing on failures
Date: Tue, 30 Jul 2024 01:15:58 -0400
Message-Id: <20240730051625.14349-12-viro@kernel.org>
In-Reply-To: <20240730051625.14349-1-viro@kernel.org>
References: <20240730050927.GC5334@ZenIV>
 <20240730051625.14349-1-viro@kernel.org>
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

Series

[01/39] memcg_write_event_control(): fix a user-triggerable oops | expand

Context	Check	Description
netdev/tree_selection	success	Guessing tree name failed - patch did not apply, async

Context

Check

Description

netdev/tree_selection

success

Guessing tree name failed - patch did not apply, async

Commit Message

Al Viro July 30, 2024, 5:15 a.m. UTC

From: Al Viro <viro@zeniv.linux.org.uk>

cleanup is convoluted enough as it is; it's easier to have early
failure outs do explicit kfree_skb(nc), rather than going to
convolutions needed to reuse the cleanup from late failures.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
 ipc/mqueue.c | 16 +++++-----------
 1 file changed, 5 insertions(+), 11 deletions(-)

diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index fd05e3d4f7b6..48640a362637 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -1347,8 +1347,8 @@  static int do_mq_notify(mqd_t mqdes, const struct sigevent *notification)
 			if (copy_from_user(nc->data,
 					notification->sigev_value.sival_ptr,
 					NOTIFY_COOKIE_LEN)) {
-				ret = -EFAULT;
-				goto free_skb;
+				kfree_skb(nc);
+				return -EFAULT;
 			}
 
 			/* TODO: add a header? */
@@ -1357,16 +1357,14 @@  static int do_mq_notify(mqd_t mqdes, const struct sigevent *notification)
 retry:
 			sock = netlink_getsockbyfd(notification->sigev_signo);
 			if (IS_ERR(sock)) {
-				ret = PTR_ERR(sock);
-				goto free_skb;
+				kfree_skb(nc);
+				return PTR_ERR(sock);
 			}
 
 			timeo = MAX_SCHEDULE_TIMEOUT;
 			ret = netlink_attachskb(sock, nc, &timeo, NULL);
-			if (ret == 1) {
-				sock = NULL;
+			if (ret == 1)
 				goto retry;
-			}
 			if (ret)
 				return ret;
 		}
@@ -1425,10 +1423,6 @@  static int do_mq_notify(mqd_t mqdes, const struct sigevent *notification)
 out:
 	if (sock)
 		netlink_detachskb(sock, nc);
-	else
-free_skb:
-		dev_kfree_skb(nc);
-
 	return ret;
 }

[12/39] do_mq_notify(): saner skb freeing on failures

Checks

Commit Message

Patch