Re: memory leakage in ncm_wrap_ntb() in USB ncm mode with kernel 5.15

Re: memory leakage in ncm_wrap_ntb() in USB ncm mode with kernel 5.15

[gregkh]

On Sun, May 19, 2024 at 10:23:10PM +0800, nanfengwq@sina.com wrote:
> Hello：
> I have discovered a risk of memory leakage in ncm_wrap_ntb() under USB ncm mode in kernel 5.15, and I have fixed it. 
> Please help me review it.
> 
> If this modification is effective, it can also be integrated into other kernel versions, such as kernel 4.14, and so on.
> 
> The logic of a memory leak is as follows:
> 
> If the return value skb2 of  package_for_tx() is not NULL, and the return value ncm->skb_tx_data of alloc_skb() is NULL, then the code will go to err, where there is no processing of skb2, resulting in a memory leak in skb2.
> 
> 
> Thank you.
> 
> 
> 
> 


Hi,

This is the friendly patch-bot of Greg Kroah-Hartman.  You have sent him
a patch that has triggered this response.  He used to manually respond
to these common problems, but in order to save his sanity (he kept
writing the same thing over and over, yet to different people), I was
created.  Hopefully you will not take offence and will fix the problem
in your patch and resubmit it so that it can be accepted into the Linux
kernel tree.

You are receiving this message because of the following common error(s)
as indicated below:

- Your patch did not apply to any known trees that Greg is in control
  of.  Possibly this is because you made it against Linus's tree, not
  the linux-next tree, which is where all of the development for the
  next version of the kernel is at.  Please refresh your patch against
  the linux-next tree, or even better yet, the development tree
  specified in the MAINTAINERS file for the subsystem you are submitting
  a patch for, and resend it.

- You did not specify a description of why the patch is needed, or
  possibly, any description at all, in the email body.  Please read the
  section entitled "The canonical patch format" in the kernel file,
  Documentation/process/submitting-patches.rst for what is needed in
  order to properly describe the change.

- You did not write a descriptive Subject: for the patch, allowing Greg,
  and everyone else, to know what this patch is all about.  Please read
  the section entitled "The canonical patch format" in the kernel file,
  Documentation/process/submitting-patches.rst for what a proper
  Subject: line should look like.

- It looks like you did not use your "real" name for the patch on either
  the Signed-off-by: line, or the From: line (both of which have to
  match).  Please read the kernel file,
  Documentation/process/submitting-patches.rst for how to do this
  correctly.

If you wish to discuss this problem further, or you have questions about
how to resolve this issue, please feel free to respond to this email and
Greg will reply once he has dug out from the pending patches received
from other developers.

thanks,

greg k-h's patch email bot

Re: memory leakage in ncm_wrap_ntb() in USB ncm mode with kernel 5.15

[nanfengwq]

[-- Attachment #1.1: Type: text/plain, Size: 3436 bytes --]

hello:
       In embedded devices with relatively small memory, if the transfer speed of ncm is fast and other programs occupy CPU memory, it is likely that the return value ncm ->skd_tx_data of alloc_skb() is NULL, and the code is likely to enter err. If skb2 is not processed in err, it will cause memory leakage.

Thank you.


nanfengwq@sina.com
 
From: gregkh
Date: 2024-05-19 22:37
To: nanfengwq@sina.com
CC: balbi; linux-usb; linux-kernel
Subject: Re: memory leakage in ncm_wrap_ntb() in USB ncm mode with kernel 5.15
On Sun, May 19, 2024 at 10:23:10PM +0800, nanfengwq@sina.com wrote:
> Hello：
> I have discovered a risk of memory leakage in ncm_wrap_ntb() under USB ncm mode in kernel 5.15, and I have fixed it. 
> Please help me review it.
> 
> If this modification is effective, it can also be integrated into other kernel versions, such as kernel 4.14, and so on.
> 
> The logic of a memory leak is as follows:
> 
> If the return value skb2 of  package_for_tx() is not NULL, and the return value ncm->skb_tx_data of alloc_skb() is NULL, then the code will go to err, where there is no processing of skb2, resulting in a memory leak in skb2.
> 
> 
> Thank you.
> 
> 
> 
> 
 
 
Hi,
 
This is the friendly patch-bot of Greg Kroah-Hartman.  You have sent him
a patch that has triggered this response.  He used to manually respond
to these common problems, but in order to save his sanity (he kept
writing the same thing over and over, yet to different people), I was
created.  Hopefully you will not take offence and will fix the problem
in your patch and resubmit it so that it can be accepted into the Linux
kernel tree.
 
You are receiving this message because of the following common error(s)
as indicated below:
 
- Your patch did not apply to any known trees that Greg is in control
  of.  Possibly this is because you made it against Linus's tree, not
  the linux-next tree, which is where all of the development for the
  next version of the kernel is at.  Please refresh your patch against
  the linux-next tree, or even better yet, the development tree
  specified in the MAINTAINERS file for the subsystem you are submitting
  a patch for, and resend it.
 
- You did not specify a description of why the patch is needed, or
  possibly, any description at all, in the email body.  Please read the
  section entitled "The canonical patch format" in the kernel file,
  Documentation/process/submitting-patches.rst for what is needed in
  order to properly describe the change.
 
- You did not write a descriptive Subject: for the patch, allowing Greg,
  and everyone else, to know what this patch is all about.  Please read
  the section entitled "The canonical patch format" in the kernel file,
  Documentation/process/submitting-patches.rst for what a proper
  Subject: line should look like.
 
- It looks like you did not use your "real" name for the patch on either
  the Signed-off-by: line, or the From: line (both of which have to
  match).  Please read the kernel file,
  Documentation/process/submitting-patches.rst for how to do this
  correctly.
 
If you wish to discuss this problem further, or you have questions about
how to resolve this issue, please feel free to respond to this email and
Greg will reply once he has dug out from the pending patches received
from other developers.
 
thanks,
 
greg k-h's patch email bot
 

[-- Attachment #1.2: Type: text/html, Size: 5885 bytes --]

[-- Attachment #2: 0001-USB-NCM-mode-There-is-a-memory-leak.patch --]
[-- Type: application/octet-stream, Size: 853 bytes --]

From 29d450b3278d5090d8b62f784e993b0eb11eec34 Mon Sep 17 00:00:00 2001
From: nanfengwq <nanfengwq@sina.com>
Date: Sat, 18 May 2024 16:15:45 +0800
Subject: [PATCH] USB(NCM mode):There is a memory leak

If skb2 is not equal to NULL and the return value of allocskb() is NULL,it will cause a memory leak

Signed-off-by: nanfengwq <nanfengwq@sina.com>
---
 drivers/usb/gadget/function/f_ncm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c
index e0c183234..c9bde7afd 100644
--- a/drivers/usb/gadget/function/f_ncm.c
+++ b/drivers/usb/gadget/function/f_ncm.c
@@ -1144,7 +1144,7 @@ static struct sk_buff *ncm_wrap_ntb(struct gether *port,
 	if (ncm->skb_tx_ndp)
 		dev_kfree_skb_any(ncm->skb_tx_ndp);
 
-	return NULL;
+	return skb2;
 }
 
 /*
-- 
2.32.0.windows.1

Re: memory leakage in ncm_wrap_ntb() in USB ncm mode with kernel 5.15

[gregkh]

On Mon, May 20, 2024 at 10:32:21PM +0800, nanfengwq@sina.com wrote:
> hello:
>        In embedded devices with relatively small memory, if the transfer speed of ncm is fast and other programs occupy CPU memory, it is likely that the return value ncm ->skd_tx_data of alloc_skb() is NULL, and the code is likely to enter err. If skb2 is not processed in err, it will cause memory leakage.

Please do not send html email, the mailing list rejects it :(

Please read how to properly send kernel patches, the in-kernel
documentation should be very complete, is there anything there that you
do not understand?

thanks,

greg k-h

Re: memory leakage in ncm_wrap_ntb() in USB ncm mode with kernel 5.15

[Oliver Neukum]

On 20.05.24 16:32, nanfengwq@sina.com wrote:
> hello:
> In embedded devices with relatively small memory, if the transfer speed of ncm is fast and other programs occupy CPU memory, it is likely that the return value ncm ->skd_tx_data of alloc_skb() is NULL, and the code is likely to enter err. If skb2 is not processed in err, it will cause memory leakage.

Hi,

apart from the submission process, could you please explain how this
condition may happem?

         if (skb) {

[..]
                 if (ncm->skb_tx_data

We know ncm->skb_tx_data != NULL && skb != NULL

                     && (ncm->ndp_dgram_count >= TX_MAX_NUM_DPE
                     || (ncm->skb_tx_data->len +
                     div + rem + skb->len +
                     ncm->skb_tx_ndp->len + ndp_align + (2 * dgram_idx_len))
                     > max_size)) {
                         skb2 = package_for_tx(ncm);


		if (!ncm->skb_tx_data) {

We know ncm->skb_tx_data == NULL && skb != NULL

                         /* Create a new skb for the NTH and datagrams. */
                         ncm->skb_tx_data = alloc_skb(max_size, GFP_ATOMIC);
                         if (!ncm->skb_tx_data)
                                 goto err;

It seems to me that either

skb2 = package_for_tx(ncm);

or

ncm->skb_tx_data = alloc_skb(max_size, GFP_ATOMIC);

can be executed. The code paths seem to be mutually exclusive.

	Regards
		Oliver