Re: [syzbot] memory leak in netlink_policy_dump_add_policy

[Jakub Kicinski <kuba@kernel.org>]

[-- Attachment #1: Type: text/plain, Size: 892 bytes --]

On Fri, 12 Aug 2022 10:04:26 -0700 syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    4e23eeebb2e5 Merge tag 'bitmap-6.0-rc1' of https://github...
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=165f4f6a080000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=3a433c7a2539f51c
> dashboard link: https://syzkaller.appspot.com/bug?extid=dc54d9ba8153b216cae0
> compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1443be71080000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=11e5918e080000
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+dc54d9ba8153b216cae0@syzkaller.appspotmail.com

Let's see if attaching a patch works...

#syz test

[-- Attachment #2: 0001-net-genl-fix-error-path-memory-leak-in-policy-dumpin.patch --]
[-- Type: text/x-patch, Size: 1180 bytes --]

From 7b3f410d5c49568deffcc8ee9881a7d3de730699 Mon Sep 17 00:00:00 2001
From: Jakub Kicinski <kuba@kernel.org>
Date: Fri, 12 Aug 2022 13:56:48 -0700
Subject: [--remember tree name--] net: genl: fix error path memory leak in
 policy dumping

If construction of the array of policies fails when recording
non-first policy we need to unwind.

Reported-by: syzbot+dc54d9ba8153b216cae0@syzkaller.appspotmail.com
Fixes: 50a896cf2d6f ("genetlink: properly support per-op policy dumping")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
 net/netlink/genetlink.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index 1afca2a6c2ac..57010927e20a 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -1174,13 +1174,17 @@ static int ctrl_dumppolicy_start(struct netlink_callback *cb)
 							     op.policy,
 							     op.maxattr);
 			if (err)
-				return err;
+				goto err_free_state;
 		}
 	}
 
 	if (!ctx->state)
 		return -ENODATA;
 	return 0;
+
+err_free_state:
+	netlink_policy_dump_free(ctx->state);
+	return err;
 }
 
 static void *ctrl_dumppolicy_prep(struct sk_buff *skb,
-- 
2.37.1