linux-ppp.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Guillaume Nault <gnault@redhat.com>
To: linux-ppp@vger.kernel.org
Subject: Re: [PATCH] ppp: Fix memory leak in ppp_write
Date: Tue, 17 Sep 2019 22:40:12 +0000	[thread overview]
Message-ID: <20190917224012.GA10899@linux.home> (raw)
In-Reply-To: <20190914040958.GA2363@DESKTOP>

On Sat, Sep 14, 2019 at 01:09:58PM +0900, Takeshi Misawa wrote:
> When ppp is closing, __ppp_xmit_process() failed to enqueue skb
> and skb allocated in ppp_write() is leaked.
> 
> syzbot reported :
> BUG: memory leak
> unreferenced object 0xffff88812a17bc00 (size 224):
>   comm "syz-executor673", pid 6952, jiffies 4294942888 (age 13.040s)
>   hex dump (first 32 bytes):
>     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>   backtrace:
>     [<00000000d110fff9>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
>     [<00000000d110fff9>] slab_post_alloc_hook mm/slab.h:522 [inline]
>     [<00000000d110fff9>] slab_alloc_node mm/slab.c:3262 [inline]
>     [<00000000d110fff9>] kmem_cache_alloc_node+0x163/0x2f0 mm/slab.c:3574
>     [<000000002d616113>] __alloc_skb+0x6e/0x210 net/core/skbuff.c:197
>     [<000000000167fc45>] alloc_skb include/linux/skbuff.h:1055 [inline]
>     [<000000000167fc45>] ppp_write+0x48/0x120 drivers/net/ppp/ppp_generic.c:502
>     [<000000009ab42c0b>] __vfs_write+0x43/0xa0 fs/read_write.c:494
>     [<00000000086b2e22>] vfs_write fs/read_write.c:558 [inline]
>     [<00000000086b2e22>] vfs_write+0xee/0x210 fs/read_write.c:542
>     [<00000000a2b70ef9>] ksys_write+0x7c/0x130 fs/read_write.c:611
>     [<00000000ce5e0fdd>] __do_sys_write fs/read_write.c:623 [inline]
>     [<00000000ce5e0fdd>] __se_sys_write fs/read_write.c:620 [inline]
>     [<00000000ce5e0fdd>] __x64_sys_write+0x1e/0x30 fs/read_write.c:620
>     [<00000000d9d7b370>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:296
>     [<0000000006e6d506>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
> 
> Fix this by freeing skb, if ppp is closing.
> 
> Reported-and-tested-by: syzbot+d9c8bf24e56416d7ce2c@syzkaller.appspotmail.com
> Signed-off-by: Takeshi Misawa <jeliantsurux@gmail.com>
> ---
> Dear Paul Mackerras
> 
> syzbot reported memory leak in net/ppp.
> [TITLE] memory leak in ppp_write
> 
> I send a patch that passed syzbot reproducer test. 
> Please consider this memory leak and patch.
> 
Hi Takeshi,

Kernel networking patches are reviewed on netdev ML. Your patch looks
good but the description misses a Fixes tag:

Fixes: 6d066734e9f0 ("ppp: avoid loop in xmit recursion detection code")

Can you please send this patch formally to netdev? Don't forget to
indicate which tree you're tagetting in the subject. In this case, it
should be [PATCH net] (see Documentation/networking/netdev-FAQ.rst for
details).

Thanks for fixing my bug :)

Guillaume

      parent reply	other threads:[~2019-09-17 22:40 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-09-14  4:09 [PATCH] ppp: Fix memory leak in ppp_write Takeshi Misawa
2019-09-14 10:36 ` walter harms
2019-09-17 22:40 ` Guillaume Nault [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190917224012.GA10899@linux.home \
    --to=gnault@redhat.com \
    --cc=linux-ppp@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).