From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Neil Horman <nhorman@tuxdriver.com>,
syzbot+f7e9153b037eac9b1df8@syzkaller.appspotmail.com,
Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>,
"David S. Miller" <davem@davemloft.net>,
netdev@vger.kernel.org
Subject: [PATCH 4.19 02/51] Fix memory leak in sctp_process_init
Date: Sun, 9 Jun 2019 18:41:43 +0200 [thread overview]
Message-ID: <20190609164127.262205526@linuxfoundation.org> (raw)
In-Reply-To: <20190609164127.123076536@linuxfoundation.org>
From: Neil Horman <nhorman@tuxdriver.com>
[ Upstream commit 0a8dd9f67cd0da7dc284f48b032ce00db1a68791 ]
syzbot found the following leak in sctp_process_init
BUG: memory leak
unreferenced object 0xffff88810ef68400 (size 1024):
comm "syz-executor273", pid 7046, jiffies 4294945598 (age 28.770s)
hex dump (first 32 bytes):
1d de 28 8d de 0b 1b e3 b5 c2 f9 68 fd 1a 97 25 ..(........h...%
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000a02cebbd>] kmemleak_alloc_recursive include/linux/kmemleak.h:55
[inline]
[<00000000a02cebbd>] slab_post_alloc_hook mm/slab.h:439 [inline]
[<00000000a02cebbd>] slab_alloc mm/slab.c:3326 [inline]
[<00000000a02cebbd>] __do_kmalloc mm/slab.c:3658 [inline]
[<00000000a02cebbd>] __kmalloc_track_caller+0x15d/0x2c0 mm/slab.c:3675
[<000000009e6245e6>] kmemdup+0x27/0x60 mm/util.c:119
[<00000000dfdc5d2d>] kmemdup include/linux/string.h:432 [inline]
[<00000000dfdc5d2d>] sctp_process_init+0xa7e/0xc20
net/sctp/sm_make_chunk.c:2437
[<00000000b58b62f8>] sctp_cmd_process_init net/sctp/sm_sideeffect.c:682
[inline]
[<00000000b58b62f8>] sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1384
[inline]
[<00000000b58b62f8>] sctp_side_effects net/sctp/sm_sideeffect.c:1194
[inline]
[<00000000b58b62f8>] sctp_do_sm+0xbdc/0x1d60 net/sctp/sm_sideeffect.c:1165
[<0000000044e11f96>] sctp_assoc_bh_rcv+0x13c/0x200
net/sctp/associola.c:1074
[<00000000ec43804d>] sctp_inq_push+0x7f/0xb0 net/sctp/inqueue.c:95
[<00000000726aa954>] sctp_backlog_rcv+0x5e/0x2a0 net/sctp/input.c:354
[<00000000d9e249a8>] sk_backlog_rcv include/net/sock.h:950 [inline]
[<00000000d9e249a8>] __release_sock+0xab/0x110 net/core/sock.c:2418
[<00000000acae44fa>] release_sock+0x37/0xd0 net/core/sock.c:2934
[<00000000963cc9ae>] sctp_sendmsg+0x2c0/0x990 net/sctp/socket.c:2122
[<00000000a7fc7565>] inet_sendmsg+0x64/0x120 net/ipv4/af_inet.c:802
[<00000000b732cbd3>] sock_sendmsg_nosec net/socket.c:652 [inline]
[<00000000b732cbd3>] sock_sendmsg+0x54/0x70 net/socket.c:671
[<00000000274c57ab>] ___sys_sendmsg+0x393/0x3c0 net/socket.c:2292
[<000000008252aedb>] __sys_sendmsg+0x80/0xf0 net/socket.c:2330
[<00000000f7bf23d1>] __do_sys_sendmsg net/socket.c:2339 [inline]
[<00000000f7bf23d1>] __se_sys_sendmsg net/socket.c:2337 [inline]
[<00000000f7bf23d1>] __x64_sys_sendmsg+0x23/0x30 net/socket.c:2337
[<00000000a8b4131f>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:3
The problem was that the peer.cookie value points to an skb allocated
area on the first pass through this function, at which point it is
overwritten with a heap allocated value, but in certain cases, where a
COOKIE_ECHO chunk is included in the packet, a second pass through
sctp_process_init is made, where the cookie value is re-allocated,
leaking the first allocation.
Fix is to always allocate the cookie value, and free it when we are done
using it.
Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
Reported-by: syzbot+f7e9153b037eac9b1df8@syzkaller.appspotmail.com
CC: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
CC: "David S. Miller" <davem@davemloft.net>
CC: netdev@vger.kernel.org
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sctp/sm_make_chunk.c | 13 +++----------
net/sctp/sm_sideeffect.c | 5 +++++
2 files changed, 8 insertions(+), 10 deletions(-)
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -2329,7 +2329,6 @@ int sctp_process_init(struct sctp_associ
union sctp_addr addr;
struct sctp_af *af;
int src_match = 0;
- char *cookie;
/* We must include the address that the INIT packet came from.
* This is the only address that matters for an INIT packet.
@@ -2433,14 +2432,6 @@ int sctp_process_init(struct sctp_associ
/* Peer Rwnd : Current calculated value of the peer's rwnd. */
asoc->peer.rwnd = asoc->peer.i.a_rwnd;
- /* Copy cookie in case we need to resend COOKIE-ECHO. */
- cookie = asoc->peer.cookie;
- if (cookie) {
- asoc->peer.cookie = kmemdup(cookie, asoc->peer.cookie_len, gfp);
- if (!asoc->peer.cookie)
- goto clean_up;
- }
-
/* RFC 2960 7.2.1 The initial value of ssthresh MAY be arbitrarily
* high (for example, implementations MAY use the size of the receiver
* advertised window).
@@ -2609,7 +2600,9 @@ do_addr_param:
case SCTP_PARAM_STATE_COOKIE:
asoc->peer.cookie_len =
ntohs(param.p->length) - sizeof(struct sctp_paramhdr);
- asoc->peer.cookie = param.cookie->body;
+ asoc->peer.cookie = kmemdup(param.cookie->body, asoc->peer.cookie_len, gfp);
+ if (!asoc->peer.cookie)
+ retval = 0;
break;
case SCTP_PARAM_HEARTBEAT_INFO:
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -898,6 +898,11 @@ static void sctp_cmd_new_state(struct sc
asoc->rto_initial;
}
+ if (sctp_state(asoc, ESTABLISHED)) {
+ kfree(asoc->peer.cookie);
+ asoc->peer.cookie = NULL;
+ }
+
if (sctp_state(asoc, ESTABLISHED) ||
sctp_state(asoc, CLOSED) ||
sctp_state(asoc, SHUTDOWN_RECEIVED)) {
next prev parent reply other threads:[~2019-06-09 17:19 UTC|newest]
Thread overview: 61+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-06-09 16:41 [PATCH 4.19 00/51] 4.19.50-stable review Greg Kroah-Hartman
2019-06-09 16:41 ` [PATCH 4.19 01/51] ethtool: fix potential userspace buffer overflow Greg Kroah-Hartman
2019-06-10 8:21 ` Pavel Machek
2019-06-10 8:42 ` Michal Kubecek
2019-06-10 14:23 ` Greg Kroah-Hartman
2019-06-09 16:41 ` Greg Kroah-Hartman [this message]
2019-06-09 16:41 ` [PATCH 4.19 03/51] ipv4: not do cache for local delivery if bc_forwarding is enabled Greg Kroah-Hartman
2019-06-09 16:41 ` [PATCH 4.19 04/51] ipv6: fix the check before getting the cookie in rt6_get_cookie Greg Kroah-Hartman
2019-06-09 16:41 ` [PATCH 4.19 05/51] neighbor: Call __ipv4_neigh_lookup_noref in neigh_xmit Greg Kroah-Hartman
2019-06-09 16:41 ` [PATCH 4.19 06/51] net: ethernet: ti: cpsw_ethtool: fix ethtool ring param set Greg Kroah-Hartman
2019-06-09 16:41 ` [PATCH 4.19 07/51] net/mlx4_en: ethtool, Remove unsupported SFP EEPROM high pages query Greg Kroah-Hartman
2019-06-09 16:41 ` [PATCH 4.19 08/51] net: mvpp2: Use strscpy to handle stat strings Greg Kroah-Hartman
2019-06-09 16:41 ` [PATCH 4.19 09/51] net: rds: fix memory leak in rds_ib_flush_mr_pool Greg Kroah-Hartman
2019-06-09 16:41 ` [PATCH 4.19 10/51] net: sfp: read eeprom in maximum 16 byte increments Greg Kroah-Hartman
2019-06-09 16:41 ` [PATCH 4.19 11/51] net/tls: replace the sleeping lock around RX resync with a bit lock Greg Kroah-Hartman
2019-06-09 16:41 ` [PATCH 4.19 12/51] packet: unconditionally free po->rollover Greg Kroah-Hartman
2019-06-09 16:41 ` [PATCH 4.19 13/51] pktgen: do not sleep with the thread lock held Greg Kroah-Hartman
2019-06-09 16:41 ` [PATCH 4.19 14/51] Revert "fib_rules: return 0 directly if an exactly same rule exists when NLM_F_EXCL not supplied" Greg Kroah-Hartman
2019-06-09 16:41 ` [PATCH 4.19 15/51] ipv6: use READ_ONCE() for inet->hdrincl as in ipv4 Greg Kroah-Hartman
2019-06-09 16:41 ` [PATCH 4.19 16/51] ipv6: fix EFAULT on sendto with icmpv6 and hdrincl Greg Kroah-Hartman
2019-06-09 16:41 ` [PATCH 4.19 17/51] mtd: spinand: macronix: Fix ECC Status Read Greg Kroah-Hartman
2019-06-09 16:41 ` [PATCH 4.19 18/51] rcu: locking and unlocking need to always be at least barriers Greg Kroah-Hartman
2019-06-09 16:42 ` [PATCH 4.19 19/51] parisc: Use implicit space register selection for loading the coherence index of I/O pdirs Greg Kroah-Hartman
2019-06-09 16:42 ` [PATCH 4.19 20/51] NFSv4.1: Again fix a race where CB_NOTIFY_LOCK fails to wake a waiter Greg Kroah-Hartman
2019-06-09 16:42 ` [PATCH 4.19 21/51] NFSv4.1: Fix bug only first CB_NOTIFY_LOCK is handled Greg Kroah-Hartman
2019-06-09 16:42 ` [PATCH 4.19 22/51] fuse: fallocate: fix return with locked inode Greg Kroah-Hartman
2019-06-09 16:42 ` [PATCH 4.19 23/51] pstore: Remove needless lock during console writes Greg Kroah-Hartman
2019-06-09 16:42 ` [PATCH 4.19 24/51] pstore: Convert buf_lock to semaphore Greg Kroah-Hartman
2019-06-09 16:42 ` [PATCH 4.19 25/51] pstore: Set tfm to NULL on free_buf_for_compression Greg Kroah-Hartman
2019-06-09 16:42 ` [PATCH 4.19 26/51] pstore/ram: Run without kernel crash dump region Greg Kroah-Hartman
2019-06-09 16:42 ` [PATCH 4.19 27/51] x86/power: Fix nosmt vs hibernation triple fault during resume Greg Kroah-Hartman
2019-06-09 16:42 ` [PATCH 4.19 28/51] x86/insn-eval: Fix use-after-free access to LDT entry Greg Kroah-Hartman
2019-06-09 16:42 ` [PATCH 4.19 29/51] i2c: xiic: Add max_read_len quirk Greg Kroah-Hartman
2019-06-09 16:42 ` [PATCH 4.19 30/51] s390/mm: fix address space detection in exception handling Greg Kroah-Hartman
2019-06-09 16:42 ` [PATCH 4.19 31/51] xen-blkfront: switch kcalloc to kvcalloc for large array allocation Greg Kroah-Hartman
2019-06-09 16:42 ` [PATCH 4.19 32/51] MIPS: Bounds check virt_addr_valid Greg Kroah-Hartman
2019-06-09 16:42 ` [PATCH 4.19 33/51] MIPS: pistachio: Build uImage.gz by default Greg Kroah-Hartman
2019-06-09 16:42 ` [PATCH 4.19 34/51] Revert "MIPS: perf: ath79: Fix perfcount IRQ assignment" Greg Kroah-Hartman
2019-06-09 16:42 ` [PATCH 4.19 35/51] genwqe: Prevent an integer overflow in the ioctl Greg Kroah-Hartman
2019-06-09 16:42 ` [PATCH 4.19 36/51] test_firmware: Use correct snprintf() limit Greg Kroah-Hartman
2019-06-09 16:42 ` [PATCH 4.19 37/51] drm/gma500/cdv: Check vbt config bits when detecting lvds panels Greg Kroah-Hartman
2019-06-09 16:42 ` [PATCH 4.19 38/51] drm/msm: fix fb references in async update Greg Kroah-Hartman
2019-06-09 16:42 ` [PATCH 4.19 39/51] drm: add non-desktop quirk for Valve HMDs Greg Kroah-Hartman
2019-06-09 16:42 ` [PATCH 4.19 40/51] drm/nouveau: add kconfig option to turn off nouveau legacy contexts. (v3) Greg Kroah-Hartman
2019-06-09 16:42 ` [PATCH 4.19 41/51] drm: add non-desktop quirks to Sensics and OSVR headsets Greg Kroah-Hartman
2019-06-09 16:42 ` [PATCH 4.19 42/51] drm/amdgpu/psp: move psp version specific function pointers to early_init Greg Kroah-Hartman
2019-06-09 16:42 ` [PATCH 4.19 43/51] drm/radeon: prefer lower reference dividers Greg Kroah-Hartman
2019-06-09 16:42 ` [PATCH 4.19 44/51] drm/amdgpu: remove ATPX_DGPU_REQ_POWER_FOR_DISPLAYS check when hotplug-in Greg Kroah-Hartman
2019-06-09 16:42 ` [PATCH 4.19 45/51] drm/i915: Fix I915_EXEC_RING_MASK Greg Kroah-Hartman
2019-06-09 16:42 ` [PATCH 4.19 46/51] drm/amdgpu/soc15: skip reset on init Greg Kroah-Hartman
2019-06-10 14:31 ` Pavel Machek
2019-06-10 14:41 ` Greg Kroah-Hartman
2019-06-09 16:42 ` [PATCH 4.19 47/51] drm/i915/fbc: disable framebuffer compression on GeminiLake Greg Kroah-Hartman
2019-06-09 16:42 ` [PATCH 4.19 48/51] drm/i915: Maintain consistent documentation subsection ordering Greg Kroah-Hartman
2019-06-09 16:42 ` [PATCH 4.19 49/51] drm: dont block fb changes for async plane updates Greg Kroah-Hartman
2019-06-09 16:42 ` [PATCH 4.19 50/51] drm/i915/gvt: Initialize intel_gvt_gtt_entry in stack Greg Kroah-Hartman
2019-06-09 16:42 ` [PATCH 4.19 51/51] TTY: serial_core, add ->install Greg Kroah-Hartman
2019-06-10 8:09 ` [PATCH 4.19 00/51] 4.19.50-stable review Naresh Kamboju
2019-06-10 8:51 ` Jon Hunter
2019-06-10 14:43 ` Guenter Roeck
2019-06-10 21:57 ` shuah
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190609164127.262205526@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=linux-kernel@vger.kernel.org \
--cc=marcelo.leitner@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=nhorman@tuxdriver.com \
--cc=stable@vger.kernel.org \
--cc=syzbot+f7e9153b037eac9b1df8@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).