• Eric Biggers's avatar
    llc: fix sk_buff leak in llc_sap_state_process() · c6ee11c3
    Eric Biggers authored
    syzbot reported:
    
        BUG: memory leak
        unreferenced object 0xffff888116270800 (size 224):
           comm "syz-executor641", pid 7047, jiffies 4294947360 (age 13.860s)
           hex dump (first 32 bytes):
             00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
             00 20 e1 2a 81 88 ff ff 00 40 3d 2a 81 88 ff ff  . .*.....@=*....
           backtrace:
             [<000000004d41b4cc>] kmemleak_alloc_recursive  include/linux/kmemleak.h:55 [inline]
             [<000000004d41b4cc>] slab_post_alloc_hook mm/slab.h:439 [inline]
             [<000000004d41b4cc>] slab_alloc_node mm/slab.c:3269 [inline]
             [<000000004d41b4cc>] kmem_cache_alloc_node+0x153/0x2a0 mm/slab.c:3579
             [<00000000506a5965>] __alloc_skb+0x6e/0x210 net/core/skbuff.c:198
             [<000000001ba5a161>] alloc_skb include/linux/skbuff.h:1058 [inline]
             [<000000001ba5a161>] alloc_skb_with_frags+0x5f/0x250  net/core/skbuff.c:5327
             [<0000000047d9c78b>] sock_alloc_send_pskb+0x269/0x2a0  net/core/sock.c:2225
             [<000000003828fe54>] sock_alloc_send_skb+0x32/0x40 net/core/sock.c:2242
             [<00000000e34d94f9>] llc_ui_sendmsg+0x10a/0x540 net/llc/af_llc.c:933
             [<00000000de2de3fb>] sock_sendmsg_nosec net/socket.c:652 [inline]
             [<00000000de2de3fb>] sock_sendmsg+0x54/0x70 net/socket.c:671
             [<000000008fe16e7a>] __sys_sendto+0x148/0x1f0 net/socket.c:1964
    	 [...]
    
    The bug is that llc_sap_state_process() always takes an extra reference
    to the skb, but sometimes neither llc_sap_next_state() nor
    llc_sap_state_process() itself drops this reference.
    
    Fix it by changing llc_sap_next_state() to never consume a reference to
    the skb, rather than sometimes do so and sometimes not.  Then remove the
    extra skb_get() and kfree_skb() from llc_sap_state_process().
    
    Reported-by: syzbot+6bf095f9becf5efef645@syzkaller.appspotmail.com
    Reported-by: syzbot+31c16aa4202dace3812e@syzkaller.appspotmail.com
    Fixes: 1da177e4 ("Linux-2.6.12-rc2")
    Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
    Signed-off-by: default avatarJakub Kicinski <jakub.kicinski@netronome.com>
    c6ee11c3
llc_sap.c 11.2 KB