From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Eric Biggers <ebiggers@google.com>,
Jakub Kicinski <jakub.kicinski@netronome.com>,
Sasha Levin <sashal@kernel.org>,
netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 4.14 10/33] llc: fix another potential sk_buff leak in llc_ui_sendmsg()
Date: Sat, 26 Oct 2019 09:20:47 -0400 [thread overview]
Message-ID: <20191026132110.4026-10-sashal@kernel.org> (raw)
In-Reply-To: <20191026132110.4026-1-sashal@kernel.org>
From: Eric Biggers <ebiggers@google.com>
[ Upstream commit fc8d5db10cbe1338a52ebc74e7feab9276721774 ]
All callers of llc_conn_state_process() except llc_build_and_send_pkt()
(via llc_ui_sendmsg() -> llc_ui_send_data()) assume that it always
consumes a reference to the skb. Fix this caller to do the same.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/llc/af_llc.c | 34 ++++++++++++++++++++--------------
net/llc/llc_conn.c | 2 ++
net/llc/llc_if.c | 12 ++++++++----
3 files changed, 30 insertions(+), 18 deletions(-)
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 2e472d5c3ea41..d552e88197133 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -113,22 +113,26 @@ static inline u8 llc_ui_header_len(struct sock *sk, struct sockaddr_llc *addr)
*
* Send data via reliable llc2 connection.
* Returns 0 upon success, non-zero if action did not succeed.
+ *
+ * This function always consumes a reference to the skb.
*/
static int llc_ui_send_data(struct sock* sk, struct sk_buff *skb, int noblock)
{
struct llc_sock* llc = llc_sk(sk);
- int rc = 0;
if (unlikely(llc_data_accept_state(llc->state) ||
llc->remote_busy_flag ||
llc->p_flag)) {
long timeout = sock_sndtimeo(sk, noblock);
+ int rc;
rc = llc_ui_wait_for_busy_core(sk, timeout);
+ if (rc) {
+ kfree_skb(skb);
+ return rc;
+ }
}
- if (unlikely(!rc))
- rc = llc_build_and_send_pkt(sk, skb);
- return rc;
+ return llc_build_and_send_pkt(sk, skb);
}
static void llc_ui_sk_init(struct socket *sock, struct sock *sk)
@@ -900,7 +904,7 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
DECLARE_SOCKADDR(struct sockaddr_llc *, addr, msg->msg_name);
int flags = msg->msg_flags;
int noblock = flags & MSG_DONTWAIT;
- struct sk_buff *skb;
+ struct sk_buff *skb = NULL;
size_t size = 0;
int rc = -EINVAL, copied = 0, hdrlen;
@@ -909,10 +913,10 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
lock_sock(sk);
if (addr) {
if (msg->msg_namelen < sizeof(*addr))
- goto release;
+ goto out;
} else {
if (llc_ui_addr_null(&llc->addr))
- goto release;
+ goto out;
addr = &llc->addr;
}
/* must bind connection to sap if user hasn't done it. */
@@ -920,7 +924,7 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
/* bind to sap with null dev, exclusive. */
rc = llc_ui_autobind(sock, addr);
if (rc)
- goto release;
+ goto out;
}
hdrlen = llc->dev->hard_header_len + llc_ui_header_len(sk, addr);
size = hdrlen + len;
@@ -929,12 +933,12 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
copied = size - hdrlen;
rc = -EINVAL;
if (copied < 0)
- goto release;
+ goto out;
release_sock(sk);
skb = sock_alloc_send_skb(sk, size, noblock, &rc);
lock_sock(sk);
if (!skb)
- goto release;
+ goto out;
skb->dev = llc->dev;
skb->protocol = llc_proto_type(addr->sllc_arphrd);
skb_reserve(skb, hdrlen);
@@ -944,29 +948,31 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
if (sk->sk_type == SOCK_DGRAM || addr->sllc_ua) {
llc_build_and_send_ui_pkt(llc->sap, skb, addr->sllc_mac,
addr->sllc_sap);
+ skb = NULL;
goto out;
}
if (addr->sllc_test) {
llc_build_and_send_test_pkt(llc->sap, skb, addr->sllc_mac,
addr->sllc_sap);
+ skb = NULL;
goto out;
}
if (addr->sllc_xid) {
llc_build_and_send_xid_pkt(llc->sap, skb, addr->sllc_mac,
addr->sllc_sap);
+ skb = NULL;
goto out;
}
rc = -ENOPROTOOPT;
if (!(sk->sk_type == SOCK_STREAM && !addr->sllc_ua))
goto out;
rc = llc_ui_send_data(sk, skb, noblock);
+ skb = NULL;
out:
- if (rc) {
- kfree_skb(skb);
-release:
+ kfree_skb(skb);
+ if (rc)
dprintk("%s: failed sending from %02X to %02X: %d\n",
__func__, llc->laddr.lsap, llc->daddr.lsap, rc);
- }
release_sock(sk);
return rc ? : copied;
}
diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c
index 444c13e752a08..7340f23e16de3 100644
--- a/net/llc/llc_conn.c
+++ b/net/llc/llc_conn.c
@@ -55,6 +55,8 @@ int sysctl_llc2_busy_timeout = LLC2_BUSY_TIME * HZ;
* (executing it's actions and changing state), upper layer will be
* indicated or confirmed, if needed. Returns 0 for success, 1 for
* failure. The socket lock has to be held before calling this function.
+ *
+ * This function always consumes a reference to the skb.
*/
int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
{
diff --git a/net/llc/llc_if.c b/net/llc/llc_if.c
index 6daf391b3e847..fc4d2bd8816f5 100644
--- a/net/llc/llc_if.c
+++ b/net/llc/llc_if.c
@@ -38,6 +38,8 @@
* closed and -EBUSY when sending data is not permitted in this state or
* LLC has send an I pdu with p bit set to 1 and is waiting for it's
* response.
+ *
+ * This function always consumes a reference to the skb.
*/
int llc_build_and_send_pkt(struct sock *sk, struct sk_buff *skb)
{
@@ -46,20 +48,22 @@ int llc_build_and_send_pkt(struct sock *sk, struct sk_buff *skb)
struct llc_sock *llc = llc_sk(sk);
if (unlikely(llc->state == LLC_CONN_STATE_ADM))
- goto out;
+ goto out_free;
rc = -EBUSY;
if (unlikely(llc_data_accept_state(llc->state) || /* data_conn_refuse */
llc->p_flag)) {
llc->failed_data_req = 1;
- goto out;
+ goto out_free;
}
ev = llc_conn_ev(skb);
ev->type = LLC_CONN_EV_TYPE_PRIM;
ev->prim = LLC_DATA_PRIM;
ev->prim_type = LLC_PRIM_TYPE_REQ;
skb->dev = llc->dev;
- rc = llc_conn_state_process(sk, skb);
-out:
+ return llc_conn_state_process(sk, skb);
+
+out_free:
+ kfree_skb(skb);
return rc;
}
--
2.20.1
next prev parent reply other threads:[~2019-10-26 13:21 UTC|newest]
Thread overview: 37+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-26 13:20 [PATCH AUTOSEL 4.14 01/33] iommu/arm-smmu: Free context bitmap in the err path of arm_smmu_init_domain_context Sasha Levin
2019-10-26 13:20 ` [PATCH AUTOSEL 4.14 02/33] mac80211_hwsim: fix incorrect dev_alloc_name failure goto Sasha Levin
2019-10-26 13:20 ` [PATCH AUTOSEL 4.14 03/33] nvme: retain split access workaround for capability reads Sasha Levin
2019-10-26 13:20 ` [PATCH AUTOSEL 4.14 04/33] net: dsa: b53: Do not clear existing mirrored port mask Sasha Levin
2019-10-26 13:20 ` [PATCH AUTOSEL 4.14 05/33] net: stmmac: gmac4+: Not all Unicast addresses may be available Sasha Levin
2019-10-26 13:20 ` [PATCH AUTOSEL 4.14 06/33] rxrpc: Fix call ref leak Sasha Levin
2019-10-26 13:20 ` [PATCH AUTOSEL 4.14 07/33] mac80211: accept deauth frames in IBSS mode Sasha Levin
2019-10-26 13:20 ` [PATCH AUTOSEL 4.14 08/33] llc: fix sk_buff leak in llc_sap_state_process() Sasha Levin
2019-10-26 13:20 ` [PATCH AUTOSEL 4.14 09/33] llc: fix sk_buff leak in llc_conn_service() Sasha Levin
2019-10-26 13:20 ` Sasha Levin [this message]
2019-10-26 13:20 ` [PATCH AUTOSEL 4.14 11/33] llc: fix sk_buff refcounting in llc_conn_state_process() Sasha Levin
2019-10-26 13:20 ` [PATCH AUTOSEL 4.14 12/33] NFC: pn533: fix use-after-free and memleaks Sasha Levin
2019-10-26 13:20 ` [PATCH AUTOSEL 4.14 13/33] iwlwifi: dbg_ini: fix memory leak in alloc_sgtable Sasha Levin
2019-10-26 13:20 ` [PATCH AUTOSEL 4.14 14/33] net: stmmac: fix length of PTP clock's name string Sasha Levin
2019-10-26 13:20 ` [PATCH AUTOSEL 4.14 15/33] bonding: fix potential NULL deref in bond_update_slave_arr Sasha Levin
2019-10-26 13:20 ` [PATCH AUTOSEL 4.14 16/33] act_mirred: Fix mirred_init_module error handling Sasha Levin
2019-10-26 13:20 ` [PATCH AUTOSEL 4.14 17/33] net: usb: qmi_wwan: add Telit 0x1050 composition Sasha Levin
2020-09-07 9:36 ` Kristian Evensen
2020-09-07 18:15 ` Sasha Levin
2020-09-08 0:33 ` Lars Melin
2020-09-08 12:12 ` Sasha Levin
2019-10-26 13:20 ` [PATCH AUTOSEL 4.14 18/33] net: avoid possible false sharing in sk_leave_memory_pressure() Sasha Levin
2019-10-26 13:20 ` [PATCH AUTOSEL 4.14 19/33] net: add {READ|WRITE}_ONCE() annotations on ->rskq_accept_head Sasha Levin
2019-10-26 13:20 ` [PATCH AUTOSEL 4.14 20/33] drm/msm/dsi: Implement reset correctly Sasha Levin
2019-10-26 13:20 ` [PATCH AUTOSEL 4.14 21/33] hrtimer: Annotate lockless access to timer->base Sasha Levin
2019-10-26 13:20 ` [PATCH AUTOSEL 4.14 22/33] xtensa: fix {get,put}_user() for 64bit values Sasha Levin
2019-10-26 13:21 ` [PATCH AUTOSEL 4.14 23/33] net: i82596: fix dma_alloc_attr for sni_82596 Sasha Levin
2019-10-26 13:21 ` [PATCH AUTOSEL 4.14 24/33] net: bcmgenet: Fix RGMII_MODE_EN value for GENET v1/2/3 Sasha Levin
2019-10-26 13:21 ` [PATCH AUTOSEL 4.14 25/33] net: usb: sr9800: fix uninitialized local variable Sasha Levin
2019-10-26 13:21 ` [PATCH AUTOSEL 4.14 26/33] md/raid0: fix warning message for parameter default_layout Sasha Levin
2019-10-26 13:21 ` [PATCH AUTOSEL 4.14 27/33] net: stmmac: disable/enable ptp_ref_clk in suspend/resume flow Sasha Levin
2019-10-26 13:21 ` [PATCH AUTOSEL 4.14 28/33] usb: hso: obey DMA rules in tiocmget Sasha Levin
2019-10-26 13:21 ` [PATCH AUTOSEL 4.14 29/33] x86/hyperv: Set pv_info.name to "Hyper-V" Sasha Levin
2019-10-26 13:21 ` [PATCH AUTOSEL 4.14 30/33] net: usb: lan78xx: Connect PHY before registering MAC Sasha Levin
2019-10-26 13:21 ` [PATCH AUTOSEL 4.14 31/33] scripts/gdb: fix lx-dmesg when CONFIG_PRINTK_CALLER is set Sasha Levin
2019-10-26 13:21 ` [PATCH AUTOSEL 4.14 32/33] ocfs2: fix error handling in ocfs2_setattr() Sasha Levin
2019-10-26 13:21 ` [PATCH AUTOSEL 4.14 33/33] scripts/gdb: fix debugging modules on s390 Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191026132110.4026-10-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=ebiggers@google.com \
--cc=jakub.kicinski@netronome.com \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).