[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20190729190839.561909247@linuxfoundation.org>
Date: Mon, 29 Jul 2019 21:21:28 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-kernel@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
stable@...r.kernel.org, Ralf Baechle <ralf@...ux-mips.org>,
Cong Wang <xiyou.wangcong@...il.com>,
"David S. Miller" <davem@...emloft.net>,
syzbot+622bdabb128acc33427d@...kaller.appspotmail.com,
syzbot+6eaef7158b19e3fec3a0@...kaller.appspotmail.com,
syzbot+9399c158fcc09b21d0d2@...kaller.appspotmail.com,
syzbot+a34e5f3d0300163f0c87@...kaller.appspotmail.com
Subject: [PATCH 4.14 197/293] netrom: hold sock when setting skb->destructor
From: Cong Wang <xiyou.wangcong@...il.com>
[ Upstream commit 4638faac032756f7eab5524be7be56bee77e426b ]
sock_efree() releases the sock refcnt, if we don't hold this refcnt
when setting skb->destructor to it, the refcnt would not be balanced.
This leads to several bug reports from syzbot.
I have checked other users of sock_efree(), all of them hold the
sock refcnt.
Fixes: c8c8218ec5af ("netrom: fix a memory leak in nr_rx_frame()")
Reported-and-tested-by: <syzbot+622bdabb128acc33427d@...kaller.appspotmail.com>
Reported-and-tested-by: <syzbot+6eaef7158b19e3fec3a0@...kaller.appspotmail.com>
Reported-and-tested-by: <syzbot+9399c158fcc09b21d0d2@...kaller.appspotmail.com>
Reported-and-tested-by: <syzbot+a34e5f3d0300163f0c87@...kaller.appspotmail.com>
Cc: Ralf Baechle <ralf@...ux-mips.org>
Signed-off-by: Cong Wang <xiyou.wangcong@...il.com>
Signed-off-by: David S. Miller <davem@...emloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
---
net/netrom/af_netrom.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -969,6 +969,7 @@ int nr_rx_frame(struct sk_buff *skb, str
window = skb->data[20];
+ sock_hold(make);
skb->sk = make;
skb->destructor = sock_efree;
make->sk_state = TCP_ESTABLISHED;
Powered by blists - more mailing lists