netdev - ip6gre_tunnel_xmit() leaking an skb?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 4 Feb 2013 14:29:01 +0200
From:	Tommi Rantala <tt.rantala@...il.com>
To:	"David S. Miller" <davem@...emloft.net>,
	Alexey Kuznetsov <kuznet@....inr.ac.ru>,
	James Morris <jmorris@...ei.org>,
	Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>,
	Patrick McHardy <kaber@...sh.net>, netdev@...r.kernel.org,
	Dmitry Kozlov <xeb@...l.ru>
Subject: ip6gre_tunnel_xmit() leaking an skb?

Hello,

kmemleak is giving me some complaints on boot:

# echo scan > /sys/kernel/debug/kmemleak
# echo scan > /sys/kernel/debug/kmemleak
[   13.084513] kmemleak: 2 new suspected memory leaks (see
/sys/kernel/debug/kmemleak)
# cat /sys/kernel/debug/kmemleak
unreferenced object 0xffff88003b4e3c00 (size 256):
  comm "dhcpcd", pid 1661, jiffies 4294670402 (age 15.097s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 80 4a 3b 00 88 ff ff  ..........J;....
  backtrace:
    [<ffffffff81b3d636>] kmemleak_alloc+0x26/0x50
    [<ffffffff81193514>] kmem_cache_alloc_node+0xb4/0x180
    [<ffffffff817c8fc0>] __alloc_skb+0x60/0x2a0
    [<ffffffff817c57c1>] sock_alloc_send_pskb+0x1d1/0x340
    [<ffffffff8190aa38>] packet_sendmsg+0xa88/0xd40
    [<ffffffff817c0b60>] sock_sendmsg+0xb0/0xe0
    [<ffffffff817c232e>] sys_sendto+0x11e/0x160
    [<ffffffff81b62859>] system_call_fastpath+0x16/0x1b
    [<ffffffffffffffff>] 0xffffffffffffffff
unreferenced object 0xffff88003af07800 (size 1024):
  comm "dhcpcd", pid 1661, jiffies 4294670402 (age 15.097s)
  hex dump (first 32 bytes):
    00 74 f0 3a 00 88 ff ff fe ed ca fe 28 00 00 00  .t.:........(...
    28 00 00 00 ad 00 00 00 f0 03 1d b7 7b cb c5 ee  (...........{...
  backtrace:
    [<ffffffff81b3d636>] kmemleak_alloc+0x26/0x50
    [<ffffffff81195ce0>] __kmalloc_node_track_caller+0xe0/0x1e0
    [<ffffffff817c8efc>] __kmalloc_reserve+0x3c/0xa0
    [<ffffffff817c8ff1>] __alloc_skb+0x91/0x2a0
    [<ffffffff817c57c1>] sock_alloc_send_pskb+0x1d1/0x340
    [<ffffffff8190aa38>] packet_sendmsg+0xa88/0xd40
    [<ffffffff817c0b60>] sock_sendmsg+0xb0/0xe0
    [<ffffffff817c232e>] sys_sendto+0x11e/0x160
    [<ffffffff81b62859>] system_call_fastpath+0x16/0x1b
    [<ffffffffffffffff>] 0xffffffffffffffff
#

Patching ip6gre_tunnel_xmit() to not return -1 fixes the kmemleak
complaint, but I have no clue if the patch is otherwise correct:

$ git diff net/ipv6/ip6_gre.c
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index c727e47..131dd09 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -960,7 +960,7 @@ static netdev_tx_t ip6gre_tunnel_xmit(struct sk_buff *skb,
        int ret;

        if (!ip6_tnl_xmit_ctl(t))
-               return -1;
+               goto tx_err;

        switch (skb->protocol) {
        case htons(ETH_P_IP):
$

Tested with v3.8-rc6.

Tommi
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html