[PATCH] connector: bump skb->users before callback invocation

Path	csiph.com!eternal-september.org!feeder.eternal-september.org!aioe.org!bofh.it!news.nic.it!robomod
From	Florian Westphal <fw@strlen.de>
Newsgroups	linux.kernel
Subject	[PATCH] connector: bump skb->users before callback invocation
Date	Thu, 31 Dec 2015 14:30:01 +0100
Message-ID	<qLLsJ-4VC-1@gated-at.bofh.it> (permalink)
References	<qLK3E-3Xl-1@gated-at.bofh.it>
X-Original-To	Dmitry Vyukov <dvyukov@google.com>
MIME-Version	1.0
Content-Type	text/plain; charset=us-ascii
Content-Disposition	inline
User-Agent	Mutt/1.5.21 (2010-09-15)
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	50
Organization	linux.* mail to news gateway
X-Original-Cc	"David S. Miller" <davem@davemloft.net>, Herbert Xu <herbert@gondor.apana.org.au>, Thomas Graf <tgraf@suug.ch>, Daniel Borkmann <daniel@iogearbox.net>, Ken-ichirou MATSUZAWA <chamaken@gmail.com>, Nicolas Dichtel <nicolas.dichtel@6wind.com>, Florian Westphal <fw@strlen.de>, netdev <netdev@vger.kernel.org>, LKML <linux-kernel@vger.kernel.org>, syzkaller <syzkaller@googlegroups.com>, Kostya Serebryany <kcc@google.com>, Alexander Potapenko <glider@google.com>, Sasha Levin <sasha.levin@oracle.com>, Eric Dumazet <edumazet@google.com>, zbr@ioremap.net
X-Original-Date	Thu, 31 Dec 2015 14:26:33 +0100
X-Original-Message-ID	<20151231132633.GA30790@breakpoint.cc>
X-Original-References	<CACT4Y+bKYO2XfY74tgUiOC7WotQ8DRBcMT=2yy3S=Ubz8bnj_g@mail.gmail.com>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1299667

Show key headers only | View raw

Dmitry reports memleak with syskaller program.
Problem is that connector bumps skb usecount but might not invoke callback.

So move skb_get to where we invoke the callback.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
---
 I wonder wth userspace can cram skb->len < NLMSG_HDRLEN
 down the kernel, it seems to beg for trouble...

diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c
index d7373ca..25693b0 100644
--- a/drivers/connector/connector.c
+++ b/drivers/connector/connector.c
@@ -179,26 +179,21 @@ static int cn_call_callback(struct sk_buff *skb)
  *
  * It checks skb, netlink header and msg sizes, and calls callback helper.
  */
-static void cn_rx_skb(struct sk_buff *__skb)
+static void cn_rx_skb(struct sk_buff *skb)
 {
 	struct nlmsghdr *nlh;
-	struct sk_buff *skb;
 	int len, err;
 
-	skb = skb_get(__skb);
-
 	if (skb->len >= NLMSG_HDRLEN) {
 		nlh = nlmsg_hdr(skb);
 		len = nlmsg_len(nlh);
 
 		if (len < (int)sizeof(struct cn_msg) ||
 		    skb->len < nlh->nlmsg_len ||
-		    len > CONNECTOR_MAX_MSG_SIZE) {
-			kfree_skb(skb);
+		    len > CONNECTOR_MAX_MSG_SIZE)
 			return;
-		}
 
-		err = cn_call_callback(skb);
+		err = cn_call_callback(skb_get(skb));
 		if (err < 0)
 			kfree_skb(skb);
 	}
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Thread

net/netlink: memory leak in netlink_sendmsg Dmitry Vyukov <dvyukov@google.com> - 2015-12-31 13:00 +0100
  [PATCH] connector: bump skb->users before callback invocation Florian Westphal <fw@strlen.de> - 2015-12-31 14:30 +0100
    Re: [PATCH] connector: bump skb->users before callback invocation David Miller <davem@davemloft.net> - 2016-01-05 03:50 +0100
      Re: [PATCH] connector: bump skb->users before callback invocation Evgeniy Polyakov <zbr@ioremap.net> - 2016-01-11 21:30 +0100

csiph-web