netdev - Re: [PATCH] net: xfrm: fix memory leak in xfrm_user_rcv

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20210630065107.GT40979@gauss3.secunet.de>
Date:   Wed, 30 Jun 2021 08:51:07 +0200
From:   Steffen Klassert <steffen.klassert@...unet.com>
To:     Pavel Skripkin <paskripkin@...il.com>
CC:     <herbert@...dor.apana.org.au>, <davem@...emloft.net>,
        <0x7f454c46@...il.com>, <netdev@...r.kernel.org>,
        <linux-kernel@...r.kernel.org>,
        <linux-kernel-mentees@...ts.linuxfoundation.org>,
        <syzbot+fb347cf82c73a90efcca@...kaller.appspotmail.com>
Subject: Re: [PATCH] net: xfrm: fix memory leak in xfrm_user_rcv_msg

On Fri, Jun 25, 2021 at 01:23:54PM +0300, Pavel Skripkin wrote:
> Syzbot reported memory leak in xfrm_user_rcv_msg(). The
> problem was is non-freed skb's frag_list.
> 
> In skb_release_all() skb_release_data() will be called only
> in case of skb->head != NULL, but netlink_skb_destructor()
> sets head to NULL. So, allocated frag_list skb should be
> freed manualy, since consume_skb() won't take care of it
> 
> Fixes: 5106f4a8acff ("xfrm/compat: Add 32=>64-bit messages translator")
> Reported-and-tested-by: syzbot+fb347cf82c73a90efcca@...kaller.appspotmail.com
> Signed-off-by: Pavel Skripkin <paskripkin@...il.com>

Applied, thanks a lot!