From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Eric Biggers <ebiggers@google.com>,
syzbot+6b825a6494a04cc0e3f7@syzkaller.appspotmail.com,
Jakub Kicinski <jakub.kicinski@netronome.com>,
Sasha Levin <sashal@kernel.org>,
netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 4.14 09/33] llc: fix sk_buff leak in llc_conn_service()
Date: Sat, 26 Oct 2019 09:20:46 -0400 [thread overview]
Message-ID: <20191026132110.4026-9-sashal@kernel.org> (raw)
In-Reply-To: <20191026132110.4026-1-sashal@kernel.org>
From: Eric Biggers <ebiggers@google.com>
[ Upstream commit b74555de21acd791f12c4a1aeaf653dd7ac21133 ]
syzbot reported:
BUG: memory leak
unreferenced object 0xffff88811eb3de00 (size 224):
comm "syz-executor559", pid 7315, jiffies 4294943019 (age 10.300s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 a0 38 24 81 88 ff ff 00 c0 f2 15 81 88 ff ff ..8$............
backtrace:
[<000000008d1c66a1>] kmemleak_alloc_recursive include/linux/kmemleak.h:55 [inline]
[<000000008d1c66a1>] slab_post_alloc_hook mm/slab.h:439 [inline]
[<000000008d1c66a1>] slab_alloc_node mm/slab.c:3269 [inline]
[<000000008d1c66a1>] kmem_cache_alloc_node+0x153/0x2a0 mm/slab.c:3579
[<00000000447d9496>] __alloc_skb+0x6e/0x210 net/core/skbuff.c:198
[<000000000cdbf82f>] alloc_skb include/linux/skbuff.h:1058 [inline]
[<000000000cdbf82f>] llc_alloc_frame+0x66/0x110 net/llc/llc_sap.c:54
[<000000002418b52e>] llc_conn_ac_send_sabme_cmd_p_set_x+0x2f/0x140 net/llc/llc_c_ac.c:777
[<000000001372ae17>] llc_exec_conn_trans_actions net/llc/llc_conn.c:475 [inline]
[<000000001372ae17>] llc_conn_service net/llc/llc_conn.c:400 [inline]
[<000000001372ae17>] llc_conn_state_process+0x1ac/0x640 net/llc/llc_conn.c:75
[<00000000f27e53c1>] llc_establish_connection+0x110/0x170 net/llc/llc_if.c:109
[<00000000291b2ca0>] llc_ui_connect+0x10e/0x370 net/llc/af_llc.c:477
[<000000000f9c740b>] __sys_connect+0x11d/0x170 net/socket.c:1840
[...]
The bug is that most callers of llc_conn_send_pdu() assume it consumes a
reference to the skb, when actually due to commit b85ab56c3f81 ("llc:
properly handle dev_queue_xmit() return value") it doesn't.
Revert most of that commit, and instead make the few places that need
llc_conn_send_pdu() to *not* consume a reference call skb_get() before.
Fixes: b85ab56c3f81 ("llc: properly handle dev_queue_xmit() return value")
Reported-by: syzbot+6b825a6494a04cc0e3f7@syzkaller.appspotmail.com
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/llc_conn.h | 2 +-
net/llc/llc_c_ac.c | 8 ++++++--
net/llc/llc_conn.c | 32 +++++++++-----------------------
3 files changed, 16 insertions(+), 26 deletions(-)
diff --git a/include/net/llc_conn.h b/include/net/llc_conn.h
index df528a6235487..ea985aa7a6c5e 100644
--- a/include/net/llc_conn.h
+++ b/include/net/llc_conn.h
@@ -104,7 +104,7 @@ void llc_sk_reset(struct sock *sk);
/* Access to a connection */
int llc_conn_state_process(struct sock *sk, struct sk_buff *skb);
-int llc_conn_send_pdu(struct sock *sk, struct sk_buff *skb);
+void llc_conn_send_pdu(struct sock *sk, struct sk_buff *skb);
void llc_conn_rtn_pdu(struct sock *sk, struct sk_buff *skb);
void llc_conn_resend_i_pdu_as_cmd(struct sock *sk, u8 nr, u8 first_p_bit);
void llc_conn_resend_i_pdu_as_rsp(struct sock *sk, u8 nr, u8 first_f_bit);
diff --git a/net/llc/llc_c_ac.c b/net/llc/llc_c_ac.c
index 4b60f68cb4925..8354ae40ec85b 100644
--- a/net/llc/llc_c_ac.c
+++ b/net/llc/llc_c_ac.c
@@ -372,6 +372,7 @@ int llc_conn_ac_send_i_cmd_p_set_1(struct sock *sk, struct sk_buff *skb)
llc_pdu_init_as_i_cmd(skb, 1, llc->vS, llc->vR);
rc = llc_mac_hdr_init(skb, llc->dev->dev_addr, llc->daddr.mac);
if (likely(!rc)) {
+ skb_get(skb);
llc_conn_send_pdu(sk, skb);
llc_conn_ac_inc_vs_by_1(sk, skb);
}
@@ -389,7 +390,8 @@ static int llc_conn_ac_send_i_cmd_p_set_0(struct sock *sk, struct sk_buff *skb)
llc_pdu_init_as_i_cmd(skb, 0, llc->vS, llc->vR);
rc = llc_mac_hdr_init(skb, llc->dev->dev_addr, llc->daddr.mac);
if (likely(!rc)) {
- rc = llc_conn_send_pdu(sk, skb);
+ skb_get(skb);
+ llc_conn_send_pdu(sk, skb);
llc_conn_ac_inc_vs_by_1(sk, skb);
}
return rc;
@@ -406,6 +408,7 @@ int llc_conn_ac_send_i_xxx_x_set_0(struct sock *sk, struct sk_buff *skb)
llc_pdu_init_as_i_cmd(skb, 0, llc->vS, llc->vR);
rc = llc_mac_hdr_init(skb, llc->dev->dev_addr, llc->daddr.mac);
if (likely(!rc)) {
+ skb_get(skb);
llc_conn_send_pdu(sk, skb);
llc_conn_ac_inc_vs_by_1(sk, skb);
}
@@ -916,7 +919,8 @@ static int llc_conn_ac_send_i_rsp_f_set_ackpf(struct sock *sk,
llc_pdu_init_as_i_cmd(skb, llc->ack_pf, llc->vS, llc->vR);
rc = llc_mac_hdr_init(skb, llc->dev->dev_addr, llc->daddr.mac);
if (likely(!rc)) {
- rc = llc_conn_send_pdu(sk, skb);
+ skb_get(skb);
+ llc_conn_send_pdu(sk, skb);
llc_conn_ac_inc_vs_by_1(sk, skb);
}
return rc;
diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c
index 56c3fb5cc8058..444c13e752a08 100644
--- a/net/llc/llc_conn.c
+++ b/net/llc/llc_conn.c
@@ -30,7 +30,7 @@
#endif
static int llc_find_offset(int state, int ev_type);
-static int llc_conn_send_pdus(struct sock *sk, struct sk_buff *skb);
+static void llc_conn_send_pdus(struct sock *sk);
static int llc_conn_service(struct sock *sk, struct sk_buff *skb);
static int llc_exec_conn_trans_actions(struct sock *sk,
struct llc_conn_state_trans *trans,
@@ -193,11 +193,11 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
return rc;
}
-int llc_conn_send_pdu(struct sock *sk, struct sk_buff *skb)
+void llc_conn_send_pdu(struct sock *sk, struct sk_buff *skb)
{
/* queue PDU to send to MAC layer */
skb_queue_tail(&sk->sk_write_queue, skb);
- return llc_conn_send_pdus(sk, skb);
+ llc_conn_send_pdus(sk);
}
/**
@@ -255,7 +255,7 @@ void llc_conn_resend_i_pdu_as_cmd(struct sock *sk, u8 nr, u8 first_p_bit)
if (howmany_resend > 0)
llc->vS = (llc->vS + 1) % LLC_2_SEQ_NBR_MODULO;
/* any PDUs to re-send are queued up; start sending to MAC */
- llc_conn_send_pdus(sk, NULL);
+ llc_conn_send_pdus(sk);
out:;
}
@@ -296,7 +296,7 @@ void llc_conn_resend_i_pdu_as_rsp(struct sock *sk, u8 nr, u8 first_f_bit)
if (howmany_resend > 0)
llc->vS = (llc->vS + 1) % LLC_2_SEQ_NBR_MODULO;
/* any PDUs to re-send are queued up; start sending to MAC */
- llc_conn_send_pdus(sk, NULL);
+ llc_conn_send_pdus(sk);
out:;
}
@@ -340,16 +340,12 @@ int llc_conn_remove_acked_pdus(struct sock *sk, u8 nr, u16 *how_many_unacked)
/**
* llc_conn_send_pdus - Sends queued PDUs
* @sk: active connection
- * @hold_skb: the skb held by caller, or NULL if does not care
*
- * Sends queued pdus to MAC layer for transmission. When @hold_skb is
- * NULL, always return 0. Otherwise, return 0 if @hold_skb is sent
- * successfully, or 1 for failure.
+ * Sends queued pdus to MAC layer for transmission.
*/
-static int llc_conn_send_pdus(struct sock *sk, struct sk_buff *hold_skb)
+static void llc_conn_send_pdus(struct sock *sk)
{
struct sk_buff *skb;
- int ret = 0;
while ((skb = skb_dequeue(&sk->sk_write_queue)) != NULL) {
struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
@@ -361,20 +357,10 @@ static int llc_conn_send_pdus(struct sock *sk, struct sk_buff *hold_skb)
skb_queue_tail(&llc_sk(sk)->pdu_unack_q, skb);
if (!skb2)
break;
- dev_queue_xmit(skb2);
- } else {
- bool is_target = skb == hold_skb;
- int rc;
-
- if (is_target)
- skb_get(skb);
- rc = dev_queue_xmit(skb);
- if (is_target)
- ret = rc;
+ skb = skb2;
}
+ dev_queue_xmit(skb);
}
-
- return ret;
}
/**
--
2.20.1
next prev parent reply other threads:[~2019-10-26 13:27 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-26 13:20 [PATCH AUTOSEL 4.14 01/33] iommu/arm-smmu: Free context bitmap in the err path of arm_smmu_init_domain_context Sasha Levin
2019-10-26 13:20 ` Sasha Levin
2019-10-26 13:20 ` [PATCH AUTOSEL 4.14 02/33] mac80211_hwsim: fix incorrect dev_alloc_name failure goto Sasha Levin
2019-10-26 13:20 ` [PATCH AUTOSEL 4.14 03/33] nvme: retain split access workaround for capability reads Sasha Levin
2019-10-26 13:20 ` Sasha Levin
2019-10-26 13:20 ` [PATCH AUTOSEL 4.14 04/33] net: dsa: b53: Do not clear existing mirrored port mask Sasha Levin
2019-10-26 13:20 ` [PATCH AUTOSEL 4.14 05/33] net: stmmac: gmac4+: Not all Unicast addresses may be available Sasha Levin
2019-10-26 13:20 ` [PATCH AUTOSEL 4.14 06/33] rxrpc: Fix call ref leak Sasha Levin
2019-10-26 13:20 ` [PATCH AUTOSEL 4.14 07/33] mac80211: accept deauth frames in IBSS mode Sasha Levin
2019-10-26 13:20 ` [PATCH AUTOSEL 4.14 08/33] llc: fix sk_buff leak in llc_sap_state_process() Sasha Levin
2019-10-26 13:20 ` Sasha Levin [this message]
2019-10-26 13:20 ` [PATCH AUTOSEL 4.14 10/33] llc: fix another potential sk_buff leak in llc_ui_sendmsg() Sasha Levin
2019-10-26 13:20 ` [PATCH AUTOSEL 4.14 11/33] llc: fix sk_buff refcounting in llc_conn_state_process() Sasha Levin
2019-10-26 13:20 ` [PATCH AUTOSEL 4.14 12/33] NFC: pn533: fix use-after-free and memleaks Sasha Levin
2019-10-26 13:20 ` [PATCH AUTOSEL 4.14 13/33] iwlwifi: dbg_ini: fix memory leak in alloc_sgtable Sasha Levin
2019-10-26 13:20 ` [PATCH AUTOSEL 4.14 14/33] net: stmmac: fix length of PTP clock's name string Sasha Levin
2019-10-26 13:20 ` [PATCH AUTOSEL 4.14 15/33] bonding: fix potential NULL deref in bond_update_slave_arr Sasha Levin
2019-10-26 13:20 ` [PATCH AUTOSEL 4.14 16/33] act_mirred: Fix mirred_init_module error handling Sasha Levin
2019-10-26 13:20 ` [PATCH AUTOSEL 4.14 17/33] net: usb: qmi_wwan: add Telit 0x1050 composition Sasha Levin
2020-09-07 9:36 ` Kristian Evensen
2020-09-07 18:15 ` Sasha Levin
2020-09-08 0:33 ` Lars Melin
2020-09-08 12:12 ` Sasha Levin
2019-10-26 13:20 ` [PATCH AUTOSEL 4.14 18/33] net: avoid possible false sharing in sk_leave_memory_pressure() Sasha Levin
2019-10-26 13:20 ` [PATCH AUTOSEL 4.14 19/33] net: add {READ|WRITE}_ONCE() annotations on ->rskq_accept_head Sasha Levin
2019-10-26 13:20 ` [PATCH AUTOSEL 4.14 20/33] drm/msm/dsi: Implement reset correctly Sasha Levin
2019-10-26 13:20 ` Sasha Levin
2019-10-26 13:20 ` [PATCH AUTOSEL 4.14 21/33] hrtimer: Annotate lockless access to timer->base Sasha Levin
2019-10-26 13:20 ` [PATCH AUTOSEL 4.14 22/33] xtensa: fix {get,put}_user() for 64bit values Sasha Levin
2019-10-26 13:21 ` [PATCH AUTOSEL 4.14 23/33] net: i82596: fix dma_alloc_attr for sni_82596 Sasha Levin
2019-10-26 13:21 ` [PATCH AUTOSEL 4.14 24/33] net: bcmgenet: Fix RGMII_MODE_EN value for GENET v1/2/3 Sasha Levin
2019-10-26 13:21 ` [PATCH AUTOSEL 4.14 25/33] net: usb: sr9800: fix uninitialized local variable Sasha Levin
2019-10-26 13:21 ` [PATCH AUTOSEL 4.14 26/33] md/raid0: fix warning message for parameter default_layout Sasha Levin
2019-10-26 13:21 ` [PATCH AUTOSEL 4.14 27/33] net: stmmac: disable/enable ptp_ref_clk in suspend/resume flow Sasha Levin
2019-10-26 13:21 ` [PATCH AUTOSEL 4.14 28/33] usb: hso: obey DMA rules in tiocmget Sasha Levin
2019-10-26 13:21 ` [PATCH AUTOSEL 4.14 29/33] x86/hyperv: Set pv_info.name to "Hyper-V" Sasha Levin
2019-10-26 13:21 ` [PATCH AUTOSEL 4.14 30/33] net: usb: lan78xx: Connect PHY before registering MAC Sasha Levin
2019-10-26 13:21 ` [PATCH AUTOSEL 4.14 31/33] scripts/gdb: fix lx-dmesg when CONFIG_PRINTK_CALLER is set Sasha Levin
2019-10-26 13:21 ` [PATCH AUTOSEL 4.14 32/33] ocfs2: fix error handling in ocfs2_setattr() Sasha Levin
2019-10-26 13:21 ` [PATCH AUTOSEL 4.14 33/33] scripts/gdb: fix debugging modules on s390 Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191026132110.4026-9-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=ebiggers@google.com \
--cc=jakub.kicinski@netronome.com \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzbot+6b825a6494a04cc0e3f7@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.