netdev - Re: [PATCH net] net/sched: act_police: fix memory leak in case of invalid control action

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20181130.171424.312630248835998502.davem@davemloft.net>
Date:   Fri, 30 Nov 2018 17:14:24 -0800 (PST)
From:   David Miller <davem@...emloft.net>
To:     dcaratti@...hat.com
Cc:     jhs@...atatu.com, xiyou.wangcong@...il.com, jiri@...nulli.us,
        netdev@...r.kernel.org, dan.carpenter@...cle.com
Subject: Re: [PATCH net] net/sched: act_police: fix memory leak in case of
 invalid control action

From: Davide Caratti <dcaratti@...hat.com>
Date: Wed, 28 Nov 2018 18:43:42 +0100

> when users set an invalid control action, kmemleak complains as follows:
> 
>  # echo clear >/sys/kernel/debug/kmemleak
>  # ./tdc.py -e b48b
>  Test b48b: Add police action with exceed goto chain control action
>  All test results:
> 
>  1..1
>  ok 1 - b48b # Add police action with exceed goto chain control action
>  about to flush the tap output if tests need to be skipped
>  done flushing skipped test tap output
>  # echo scan >/sys/kernel/debug/kmemleak
>  # cat /sys/kernel/debug/kmemleak
>  unreferenced object 0xffffa0fafbc3dde0 (size 96):
>   comm "tc", pid 2358, jiffies 4294922738 (age 17.022s)
>   hex dump (first 32 bytes):
>     2a 00 00 20 00 00 00 00 00 00 7d 00 00 00 00 00  *.. ......}.....
>     f8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>   backtrace:
>     [<00000000648803d2>] tcf_action_init_1+0x384/0x4c0
>     [<00000000cb69382e>] tcf_action_init+0x12b/0x1a0
>     [<00000000847ef0d4>] tcf_action_add+0x73/0x170
>     [<0000000093656e14>] tc_ctl_action+0x122/0x160
>     [<0000000023c98e32>] rtnetlink_rcv_msg+0x263/0x2d0
>     [<000000003493ae9c>] netlink_rcv_skb+0x4d/0x130
>     [<00000000de63f8ba>] netlink_unicast+0x209/0x2d0
>     [<00000000c3da0ebe>] netlink_sendmsg+0x2c1/0x3c0
>     [<000000007a9e0753>] sock_sendmsg+0x33/0x40
>     [<00000000457c6d2e>] ___sys_sendmsg+0x2a0/0x2f0
>     [<00000000c5c6a086>] __sys_sendmsg+0x5e/0xa0
>     [<00000000446eafce>] do_syscall_64+0x5b/0x180
>     [<000000004aa871f2>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
>     [<00000000450c38ef>] 0xffffffffffffffff
> 
> change tcf_police_init() to avoid leaking 'new' in case TCA_POLICE_RESULT
> contains TC_ACT_GOTO_CHAIN extended action.
> 
> Fixes: c08f5ed5d625 ("net/sched: act_police: disallow 'goto chain' on fallback control action")
> Reported-by: Dan Carpenter <dan.carpenter@...cle.com>
> Signed-off-by: Davide Caratti <dcaratti@...hat.com>

Applied.