netdev - Re: Followup: Kernel memory leak on 4.11+ & 5.3.x with IPsec

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 2 Dec 2019 12:10:32 -0600
From:   JD <jdtxs00@...il.com>
To:     Steffen Klassert <steffen.klassert@...unet.com>
Cc:     netdev@...r.kernel.org, gregkh@...uxfoundation.org
Subject: Re: Followup: Kernel memory leak on 4.11+ & 5.3.x with IPsec

Hello,

I noticed the patch hasn't been in the last two stable releases for 4.14 
and 4.19.  I checked the 4.14.157 and 4.19.87 release but the 
xfrm_state.c file doesn't have the patch.

Any update on or eta when this patch will backported to those two?  
Also, I suppose 5.3.14 will need it as well.

Thank you.

On 11/11/2019 12:28 AM, Steffen Klassert wrote:
> On Mon, Nov 04, 2019 at 12:25:37PM -0600, JD wrote:
>> Hello Steffen,
>>
>> I left the stress test running over the weekend and everything still looks
>> great. Your patch definitely resolves the leak.
> I've just applied the patch below to the IPsec tree.
>
> Thanks again for reporting and testing!
>
> Subject: [PATCH] xfrm: Fix memleak on xfrm state destroy
>
> We leak the page that we use to create skb page fragments
> when destroying the xfrm_state. Fix this by dropping a
> page reference if a page was assigned to the xfrm_state.
>
> Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible")
> Reported-by: JD <jdtxs00@...il.com>
> Reported-by: Paul Wouters <paul@...ats.ca>
> Signed-off-by: Steffen Klassert <steffen.klassert@...unet.com>
> ---
>   net/xfrm/xfrm_state.c | 2 ++
>   1 file changed, 2 insertions(+)
>
> diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
> index c6f3c4a1bd99..f3423562d933 100644
> --- a/net/xfrm/xfrm_state.c
> +++ b/net/xfrm/xfrm_state.c
> @@ -495,6 +495,8 @@ static void ___xfrm_state_destroy(struct xfrm_state *x)
>   		x->type->destructor(x);
>   		xfrm_put_type(x->type);
>   	}
> +	if (x->xfrag.page)
> +		put_page(x->xfrag.page);
>   	xfrm_dev_state_free(x);
>   	security_xfrm_state_free(x);
>   	xfrm_state_free(x);