From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9F22BC4741F for ; Mon, 9 Nov 2020 13:48:22 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 4F498206E3 for ; Mon, 9 Nov 2020 13:48:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1604929702; bh=wOKd70eCl0dYc/plvXuW6jYdj0jygRl90Hi7NnE0zwo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=yTYJijrnS7GL1+rPQUm0nJ5X3X+Ib+eewqafgmlmZL2mTJE0muoW8vMJg+iHdU7qA G9wqL9IVq7CSmwxwR/8PYD51AUMCyk9lK277uKJ//eMN0to7s6U2aMFL0N4jw7qNDg vm8Ll62NZcltGHzIeqIkj7dBfu8gxtKOTo60QGz4= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730337AbgKINsT (ORCPT ); Mon, 9 Nov 2020 08:48:19 -0500 Received: from mail.kernel.org ([198.145.29.99]:50962 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729673AbgKIM4I (ORCPT ); Mon, 9 Nov 2020 07:56:08 -0500 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 236902084C; Mon, 9 Nov 2020 12:56:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1604926566; bh=wOKd70eCl0dYc/plvXuW6jYdj0jygRl90Hi7NnE0zwo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OmdRnmJRTwrsB/IQ8eneIODzbPb8+tkAmpu5FG6PO41Fvs/bNqFJF78AW9TkJ66V4 DiUe7JEHulh1D3fyPl0ffP8D5Kaag57y0gEv0+BEoYXbEv4JXyZmFUUW6VexB+2ynq JloQ9jen2W4g3l04Gti6VN1H37sk26o+6uzRvUPo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jon Maloy , Thang Hoang Ngo , Tung Nguyen , Xin Long , Cong Wang , Jakub Kicinski Subject: [PATCH 4.4 06/86] tipc: fix memory leak caused by tipc_buf_append() Date: Mon, 9 Nov 2020 13:54:13 +0100 Message-Id: <20201109125021.170376387@linuxfoundation.org> X-Mailer: git-send-email 2.29.2 In-Reply-To: <20201109125020.852643676@linuxfoundation.org> References: <20201109125020.852643676@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Tung Nguyen [ Upstream commit ceb1eb2fb609c88363e06618b8d4bbf7815a4e03 ] Commit ed42989eab57 ("tipc: fix the skb_unshare() in tipc_buf_append()") replaced skb_unshare() with skb_copy() to not reduce the data reference counter of the original skb intentionally. This is not the correct way to handle the cloned skb because it causes memory leak in 2 following cases: 1/ Sending multicast messages via broadcast link The original skb list is cloned to the local skb list for local destination. After that, the data reference counter of each skb in the original list has the value of 2. This causes each skb not to be freed after receiving ACK: tipc_link_advance_transmq() { ... /* release skb */ __skb_unlink(skb, &l->transmq); kfree_skb(skb); <-- memory exists after being freed } 2/ Sending multicast messages via replicast link Similar to the above case, each skb cannot be freed after purging the skb list: tipc_mcast_xmit() { ... __skb_queue_purge(pkts); <-- memory exists after being freed } This commit fixes this issue by using skb_unshare() instead. Besides, to avoid use-after-free error reported by KASAN, the pointer to the fragment is set to NULL before calling skb_unshare() to make sure that the original skb is not freed after freeing the fragment 2 times in case skb_unshare() returns NULL. Fixes: ed42989eab57 ("tipc: fix the skb_unshare() in tipc_buf_append()") Acked-by: Jon Maloy Reported-by: Thang Hoang Ngo Signed-off-by: Tung Nguyen Reviewed-by: Xin Long Acked-by: Cong Wang Link: https://lore.kernel.org/r/20201027032403.1823-1-tung.q.nguyen@dektech.com.au Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman --- net/tipc/msg.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) --- a/net/tipc/msg.c +++ b/net/tipc/msg.c @@ -138,12 +138,11 @@ int tipc_buf_append(struct sk_buff **hea if (fragid == FIRST_FRAGMENT) { if (unlikely(head)) goto err; - if (skb_cloned(frag)) - frag = skb_copy(frag, GFP_ATOMIC); + *buf = NULL; + frag = skb_unshare(frag, GFP_ATOMIC); if (unlikely(!frag)) goto err; head = *headbuf = frag; - *buf = NULL; TIPC_SKB_CB(head)->tail = NULL; if (skb_is_nonlinear(head)) { skb_walk_frags(head, tail) {