Re: [syzbot] memory leak in xfrm_user_rcv_msg

[Pavel Skripkin <paskripkin@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 921 bytes --]

On Tue, 22 Jun 2021 12:04:23 -0700
syzbot <syzbot+fb347cf82c73a90efcca@syzkaller.appspotmail.com> wrote:

> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    fd0aa1a4 Merge tag 'for-linus' of
> git://git.kernel.org/pub.. git tree:       upstream
> console output:
> https://syzkaller.appspot.com/x/log.txt?x=17464aa4300000 kernel
> config:  https://syzkaller.appspot.com/x/.config?x=6ec2526c74098317
> dashboard link:
> https://syzkaller.appspot.com/bug?extid=fb347cf82c73a90efcca syz
> repro:
> https://syzkaller.appspot.com/x/repro.syz?x=14946548300000 C
> reproducer:   https://syzkaller.appspot.com/x/repro.c?x=10d28548300000
> 
> IMPORTANT: if you fix the issue, please add the following tag to the
> commit: Reported-by:
> syzbot+fb347cf82c73a90efcca@syzkaller.appspotmail.com
> 


#syz test
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master


With regards,
Pavel Skripkin

[-- Attachment #2: 0001-net-xfrm-fix-memory-leak-in-xfrm_user_rcv_msg.patch --]
[-- Type: text/x-patch, Size: 1064 bytes --]

From 6c124b1a50375215dcb6fae3f443a70340af1d47 Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Thu, 24 Jun 2021 22:10:25 +0300
Subject: [PATCH] net: xfrm: fix memory leak in xfrm_user_rcv_msg

/* ...... */

Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
---
 net/xfrm/xfrm_user.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index f0aecee4d539..ff60ff804074 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -2811,6 +2811,16 @@ static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
 
 	err = link->doit(skb, nlh, attrs);
 
+	/* We need to free skb allocated in xfrm_alloc_compat() before
+	 * returning from this function, because consume_skb() won't take
+	 * care of frag_list since netlink destructor sets
+	 * sbk->head to NULL. (see netlink_skb_destructor())
+	 */
+	if (skb_has_frag_list(skb)) {
+		kfree_skb(skb_shinfo(skb)->frag_list);
+		skb_shinfo(skb)->frag_list = NULL;
+	}
+
 err:
 	kvfree(nlh64);
 	return err;
-- 
2.32.0