• Eric Dumazet's avatar
    nfc: fix memory leak in llcp_sock_bind() · a0c2dc1f
    Eric Dumazet authored
    sysbot reported a memory leak after a bind() has failed.
    
    While we are at it, abort the operation if kmemdup() has failed.
    
    BUG: memory leak
    unreferenced object 0xffff888105d83ec0 (size 32):
      comm "syz-executor067", pid 7207, jiffies 4294956228 (age 19.430s)
      hex dump (first 32 bytes):
        00 69 6c 65 20 72 65 61 64 00 6e 65 74 3a 5b 34  .ile read.net:[4
        30 32 36 35 33 33 30 39 37 5d 00 00 00 00 00 00  026533097]......
      backtrace:
        [<0000000036bac473>] kmemleak_alloc_recursive /./include/linux/kmemleak.h:43 [inline]
        [<0000000036bac473>] slab_post_alloc_hook /mm/slab.h:522 [inline]
        [<0000000036bac473>] slab_alloc /mm/slab.c:3319 [inline]
        [<0000000036bac473>] __do_kmalloc /mm/slab.c:3653 [inline]
        [<0000000036bac473>] __kmalloc_track_caller+0x169/0x2d0 /mm/slab.c:3670
        [<000000000cd39d07>] kmemdup+0x27/0x60 /mm/util.c:120
        [<000000008e57e5fc>] kmemdup /./include/linux/string.h:432 [inline]
        [<000000008e57e5fc>] llcp_sock_bind+0x1b3/0x230 /net/nfc/llcp_sock.c:107
        [<000000009cb0b5d3>] __sys_bind+0x11c/0x140 /net/socket.c:1647
        [<00000000492c3bbc>] __do_sys_bind /net/socket.c:1658 [inline]
        [<00000000492c3bbc>] __se_sys_bind /net/socket.c:1656 [inline]
        [<00000000492c3bbc>] __x64_sys_bind+0x1e/0x30 /net/socket.c:1656
        [<0000000008704b2a>] do_syscall_64+0x76/0x1a0 /arch/x86/entry/common.c:296
        [<000000009f4c57a4>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
    
    Fixes: 30cc4587 ("NFC: Move LLCP code to the NFC top level diirectory")
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    a0c2dc1f
llcp_sock.c 22 KB