syzbot reports a memory leak in pppoe_sendmsg in 6.6 and 6.1 stable releases. The problem has been fixed by the following patch which can be cleanly applied to the 6.6 and 6.1 branches.
Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with Syzkaller
Gavrilov Ilia (1): pppoe: Fix memory leak in pppoe_sendmsg()
drivers/net/ppp/pppoe.c | 23 +++++++++-------------- 1 file changed, 9 insertions(+), 14 deletions(-)
From: Gavrilov Ilia Ilia.Gavrilov@infotecs.ru
commit dc34ebd5c018b0edf47f39d11083ad8312733034 upstream.
syzbot reports a memory leak in pppoe_sendmsg [1].
The problem is in the pppoe_recvmsg() function that handles errors in the wrong order. For the skb_recv_datagram() function, check the pointer to skb for NULL first, and then check the 'error' variable, because the skb_recv_datagram() function can set 'error' to -EAGAIN in a loop but return a correct pointer to socket buffer after a number of attempts, though 'error' remains set to -EAGAIN.
skb_recv_datagram __skb_recv_datagram // Loop. if (err == -EAGAIN) then // go to the next loop iteration __skb_try_recv_datagram // if (skb != NULL) then return 'skb' // else if a signal is received then // return -EAGAIN
Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with Syzkaller.
Link: https://syzkaller.appspot.com/bug?extid=6bdfd184eac7709e5cc9 [1]
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+6bdfd184eac7709e5cc9@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6bdfd184eac7709e5cc9 Signed-off-by: Gavrilov Ilia Ilia.Gavrilov@infotecs.ru Reviewed-by: Guillaume Nault gnault@redhat.com Link: https://lore.kernel.org/r/20240214085814.3894917-1-Ilia.Gavrilov@infotecs.ru Signed-off-by: Jakub Kicinski kuba@kernel.org --- drivers/net/ppp/pppoe.c | 23 +++++++++-------------- 1 file changed, 9 insertions(+), 14 deletions(-)
diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c index d7f50b835050..70e29e1ac4c8 100644 --- a/drivers/net/ppp/pppoe.c +++ b/drivers/net/ppp/pppoe.c @@ -983,27 +983,22 @@ static int pppoe_recvmsg(struct socket *sock, struct msghdr *m, struct sk_buff *skb; int error = 0;
-if (sk->sk_state & PPPOX_BOUND) { -error = -EIO; -goto end; -} +if (sk->sk_state & PPPOX_BOUND) +return -EIO;
skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT, flags & MSG_DONTWAIT, &error); -if (error < 0) -goto end; +if (!skb) +return error;
-if (skb) { -total_len = min_t(size_t, total_len, skb->len); -error = skb_copy_datagram_msg(skb, 0, m, total_len); -if (error == 0) { -consume_skb(skb); -return total_len; -} +total_len = min_t(size_t, total_len, skb->len); +error = skb_copy_datagram_msg(skb, 0, m, total_len); +if (error == 0) { +consume_skb(skb); +return total_len; }
kfree_skb(skb); -end: return error; }
-- 2.39.2
С уважением, Илья Гаврилов Ведущий программист Отдел разработки АО "ИнфоТеКС" в г. Санкт-Петербург 127287, г. Москва, Старый Петровско-Разумовский проезд, дом 1/23, стр. 1 T: +7 495 737-61-92 ( доб. 4921) Ф: +7 495 737-72-78
Ilia.Gavrilov@infotecs.ru www.infotecs.ru
On 3/21/24 12:12, Gavrilov Ilia wrote:
syzbot reports a memory leak in pppoe_sendmsg in 6.6 and 6.1 stable releases. The problem has been fixed by the following patch which can be cleanly applied to the 6.6 and 6.1 branches.
Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with Syzkaller
Gavrilov Ilia (1): pppoe: Fix memory leak in pppoe_sendmsg()
drivers/net/ppp/pppoe.c | 23 +++++++++-------------- 1 file changed, 9 insertions(+), 14 deletions(-)
I'm so sorry. I meant the branches 5.15, 5.10, 5.4, 4.19.
linux-stable-mirror@lists.linaro.org
-
Gavrilov Ilia