From: Cong Wang <xiyou.wangcong@gmail.com>
To: netdev@vger.kernel.org
Cc: bpf@vger.kernel.org, Cong Wang <cong.wang@bytedance.com>,
John Fastabend <john.fastabend@gmail.com>,
Daniel Borkmann <daniel@iogearbox.net>,
Jakub Sitnicki <jakub@cloudflare.com>,
Lorenz Bauer <lmb@cloudflare.com>
Subject: [PATCH RESEND bpf v3 3/8] udp: fix a memory leak in udp_read_sock()
Date: Mon, 14 Jun 2021 19:13:37 -0700 [thread overview]
Message-ID: <20210615021342.7416-4-xiyou.wangcong@gmail.com> (raw)
In-Reply-To: <20210615021342.7416-1-xiyou.wangcong@gmail.com>
From: Cong Wang <cong.wang@bytedance.com>
sk_psock_verdict_recv() clones the skb and uses the clone
afterward, so udp_read_sock() should free the skb after using
it, regardless of error or not.
This fixes a real kmemleak.
Fixes: d7f571188ecf ("udp: Implement ->read_sock() for sockmap")
Cc: John Fastabend <john.fastabend@gmail.com>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Jakub Sitnicki <jakub@cloudflare.com>
Cc: Lorenz Bauer <lmb@cloudflare.com>
Signed-off-by: Cong Wang <cong.wang@bytedance.com>
---
net/ipv4/udp.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 15f5504adf5b..e31d67fd5183 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1798,11 +1798,13 @@ int udp_read_sock(struct sock *sk, read_descriptor_t *desc,
if (used <= 0) {
if (!copied)
copied = used;
+ kfree_skb(skb);
break;
} else if (used <= skb->len) {
copied += used;
}
+ kfree_skb(skb);
if (!desc->count)
break;
}
--
2.25.1
next prev parent reply other threads:[~2021-06-15 2:46 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-06-15 2:13 [PATCH RESEND bpf v3 0/8] sock_map: some bug fixes and improvements Cong Wang
2021-06-15 2:13 ` [PATCH RESEND bpf v3 1/8] skmsg: improve udp_bpf_recvmsg() accuracy Cong Wang
2021-06-15 2:13 ` [PATCH RESEND bpf v3 2/8] selftests/bpf: Retry for EAGAIN in udp_redir_to_connected() Cong Wang
2021-06-15 2:13 ` Cong Wang [this message]
2021-06-15 2:13 ` [PATCH RESEND bpf v3 4/8] skmsg: clear skb redirect pointer before dropping it Cong Wang
2021-06-15 2:13 ` [PATCH RESEND bpf v3 5/8] skmsg: fix a memory leak in sk_psock_verdict_apply() Cong Wang
2021-06-15 2:13 ` [PATCH RESEND bpf v3 6/8] skmsg: teach sk_psock_verdict_apply() to return errors Cong Wang
2021-06-15 2:13 ` [PATCH RESEND bpf v3 7/8] skmsg: pass source psock to sk_psock_skb_redirect() Cong Wang
2021-06-15 2:13 ` [PATCH RESEND bpf v3 8/8] skmsg: increase sk->sk_drops when dropping packets Cong Wang
2021-06-19 9:57 ` [PATCH RESEND bpf v3 0/8] sock_map: some bug fixes and improvements Jakub Sitnicki
2021-06-21 15:00 ` patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210615021342.7416-4-xiyou.wangcong@gmail.com \
--to=xiyou.wangcong@gmail.com \
--cc=bpf@vger.kernel.org \
--cc=cong.wang@bytedance.com \
--cc=daniel@iogearbox.net \
--cc=jakub@cloudflare.com \
--cc=john.fastabend@gmail.com \
--cc=lmb@cloudflare.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.