* memory leak in pfkey_xfrm_policy2msg_prep
@ 2019-05-25 17:38 syzbot
2019-05-25 18:02 ` [PATCH net] af_key: fix leaks in key_pol_get_resp and dump_sp Jeremy Sowden
0 siblings, 1 reply; 4+ messages in thread
From: syzbot @ 2019-05-25 17:38 UTC (permalink / raw)
To: davem, herbert, linux-kernel, netdev, steffen.klassert, syzkaller-bugs
Hello,
syzbot found the following crash on:
HEAD commit: 4dde821e Merge tag 'xfs-5.2-fixes-1' of git://git.kernel.o..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=176fcb8aa00000
kernel config: https://syzkaller.appspot.com/x/.config?x=61dd9e15a761691d
dashboard link: https://syzkaller.appspot.com/bug?extid=4f0529365f7f2208d9f0
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=179bd84ca00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=124004a2a00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+4f0529365f7f2208d9f0@syzkaller.appspotmail.com
ed '10.128.1.31' (ECDSA) to the list of known hosts.
executing program
executing program
executing program
BUG: memory leak
unreferenced object 0xffff888126306200 (size 224):
comm "softirq", pid 0, jiffies 4294944009 (age 13.770s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000dbfa6a53>] kmemleak_alloc_recursive
include/linux/kmemleak.h:55 [inline]
[<00000000dbfa6a53>] slab_post_alloc_hook mm/slab.h:439 [inline]
[<00000000dbfa6a53>] slab_alloc_node mm/slab.c:3269 [inline]
[<00000000dbfa6a53>] kmem_cache_alloc_node+0x153/0x2a0 mm/slab.c:3579
[<00000000963741ad>] __alloc_skb+0x6e/0x210 net/core/skbuff.c:198
[<000000006fea5c94>] alloc_skb include/linux/skbuff.h:1058 [inline]
[<000000006fea5c94>] pfkey_xfrm_policy2msg_prep+0x2a/0x50
net/key/af_key.c:2054
[<0000000069777b1f>] dump_sp net/key/af_key.c:2692 [inline]
[<0000000069777b1f>] dump_sp+0x64/0x110 net/key/af_key.c:2682
[<000000006ac00402>] xfrm_policy_walk+0xd4/0x230
net/xfrm/xfrm_policy.c:1841
[<00000000f7271518>] pfkey_dump_sp+0x2a/0x30 net/key/af_key.c:2719
[<00000000652376b8>] pfkey_do_dump+0x3b/0xe0 net/key/af_key.c:289
[<000000006ac94254>] pfkey_spddump+0x81/0xb0 net/key/af_key.c:2746
[<000000006bacb6ca>] pfkey_process+0x28a/0x2d0 net/key/af_key.c:2836
[<0000000037320f8e>] pfkey_sendmsg+0x188/0x2e0 net/key/af_key.c:3675
[<0000000026dba653>] sock_sendmsg_nosec net/socket.c:652 [inline]
[<0000000026dba653>] sock_sendmsg+0x54/0x70 net/socket.c:671
[<000000004931d76f>] ___sys_sendmsg+0x393/0x3c0 net/socket.c:2292
[<00000000ca71443f>] __sys_sendmsg+0x80/0xf0 net/socket.c:2330
[<000000005d43081c>] __do_sys_sendmsg net/socket.c:2339 [inline]
[<000000005d43081c>] __se_sys_sendmsg net/socket.c:2337 [inline]
[<000000005d43081c>] __x64_sys_sendmsg+0x23/0x30 net/socket.c:2337
[<000000005fdf8054>] do_syscall_64+0x76/0x1a0
arch/x86/entry/common.c:301
[<000000000c8dd476>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH net] af_key: fix leaks in key_pol_get_resp and dump_sp.
2019-05-25 17:38 memory leak in pfkey_xfrm_policy2msg_prep syzbot
@ 2019-05-25 18:02 ` Jeremy Sowden
2019-05-25 18:09 ` [PATCH net v2] " Jeremy Sowden
0 siblings, 1 reply; 4+ messages in thread
From: Jeremy Sowden @ 2019-05-25 18:02 UTC (permalink / raw)
To: Steffen Klassert, Herbert Xu, David S. Miller, netdev
Cc: syzbot+4f0529365f7f2208d9f0
In both functions, if pfkey_xfrm_policy2msg failed we leaked the newly
allocated sk_buff. Free it on error.
Fixes: 55569ce256ce ("Fix conversion between IPSEC_MODE_xxx and XFRM_MODE_xxx.")
Reported-by: syzbot+4f0529365f7f2208d9f0@syzkaller.appspotmail.com
Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
---
net/key/af_key.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 4af1e1d60b9f..4cca397fd032 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -2442,8 +2442,10 @@ static int key_pol_get_resp(struct sock *sk, struct xfrm_policy *xp, const struc
goto out;
}
err = pfkey_xfrm_policy2msg(out_skb, xp, dir);
- if (err < 0)
- goto out;
+ if (err < 0) {
+ kfree_skb(out_skb);
+ return err;
+ }
out_hdr = (struct sadb_msg *) out_skb->data;
out_hdr->sadb_msg_version = hdr->sadb_msg_version;
@@ -2694,8 +2696,10 @@ static int dump_sp(struct xfrm_policy *xp, int dir, int count, void *ptr)
return PTR_ERR(out_skb);
err = pfkey_xfrm_policy2msg(out_skb, xp, dir);
- if (err < 0)
+ if (err < 0) {
+ kfree_skb(out_skb);
return err;
+ }
out_hdr = (struct sadb_msg *) out_skb->data;
out_hdr->sadb_msg_version = pfk->dump.msg_version;
--
2.20.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH net v2] af_key: fix leaks in key_pol_get_resp and dump_sp.
2019-05-25 18:02 ` [PATCH net] af_key: fix leaks in key_pol_get_resp and dump_sp Jeremy Sowden
@ 2019-05-25 18:09 ` Jeremy Sowden
2019-05-28 7:45 ` Steffen Klassert
0 siblings, 1 reply; 4+ messages in thread
From: Jeremy Sowden @ 2019-05-25 18:09 UTC (permalink / raw)
To: Steffen Klassert, Herbert Xu, David S. Miller, netdev
Cc: syzbot+4f0529365f7f2208d9f0
In both functions, if pfkey_xfrm_policy2msg failed we leaked the newly
allocated sk_buff. Free it on error.
Fixes: 55569ce256ce ("Fix conversion between IPSEC_MODE_xxx and XFRM_MODE_xxx.")
Reported-by: syzbot+4f0529365f7f2208d9f0@syzkaller.appspotmail.com
Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
---
Since v1.
* Changed return back to goto in key_pol_get_resp.
net/key/af_key.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 4af1e1d60b9f..51c0f10bb131 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -2442,8 +2442,10 @@ static int key_pol_get_resp(struct sock *sk, struct xfrm_policy *xp, const struc
goto out;
}
err = pfkey_xfrm_policy2msg(out_skb, xp, dir);
- if (err < 0)
+ if (err < 0) {
+ kfree_skb(out_skb);
goto out;
+ }
out_hdr = (struct sadb_msg *) out_skb->data;
out_hdr->sadb_msg_version = hdr->sadb_msg_version;
@@ -2694,8 +2696,10 @@ static int dump_sp(struct xfrm_policy *xp, int dir, int count, void *ptr)
return PTR_ERR(out_skb);
err = pfkey_xfrm_policy2msg(out_skb, xp, dir);
- if (err < 0)
+ if (err < 0) {
+ kfree_skb(out_skb);
return err;
+ }
out_hdr = (struct sadb_msg *) out_skb->data;
out_hdr->sadb_msg_version = pfk->dump.msg_version;
--
2.20.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH net v2] af_key: fix leaks in key_pol_get_resp and dump_sp.
2019-05-25 18:09 ` [PATCH net v2] " Jeremy Sowden
@ 2019-05-28 7:45 ` Steffen Klassert
0 siblings, 0 replies; 4+ messages in thread
From: Steffen Klassert @ 2019-05-28 7:45 UTC (permalink / raw)
To: Jeremy Sowden
Cc: Herbert Xu, David S. Miller, netdev, syzbot+4f0529365f7f2208d9f0
On Sat, May 25, 2019 at 07:09:35PM +0100, Jeremy Sowden wrote:
> In both functions, if pfkey_xfrm_policy2msg failed we leaked the newly
> allocated sk_buff. Free it on error.
>
> Fixes: 55569ce256ce ("Fix conversion between IPSEC_MODE_xxx and XFRM_MODE_xxx.")
> Reported-by: syzbot+4f0529365f7f2208d9f0@syzkaller.appspotmail.com
> Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
Applied, thanks Jeremy!
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2019-05-28 7:45 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-05-25 17:38 memory leak in pfkey_xfrm_policy2msg_prep syzbot
2019-05-25 18:02 ` [PATCH net] af_key: fix leaks in key_pol_get_resp and dump_sp Jeremy Sowden
2019-05-25 18:09 ` [PATCH net v2] " Jeremy Sowden
2019-05-28 7:45 ` Steffen Klassert
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.