netdev - Re: [PATCH bpf-next v2 1/4] bpf, sockmap: Fix memleak in sk_psock_queue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 4 Mar 2022 14:45:58 +0800
From:   wangyufen <wangyufen@...wei.com>
To:     Cong Wang <xiyou.wangcong@...il.com>
CC:     <john.fastabend@...il.com>, <daniel@...earbox.net>,
        <jakub@...udflare.com>, <lmb@...udflare.com>,
        <davem@...emloft.net>, <edumazet@...gle.com>,
        <yoshfuji@...ux-ipv6.org>, <dsahern@...nel.org>, <kuba@...nel.org>,
        <ast@...nel.org>, <andrii@...nel.org>, <kafai@...com>,
        <songliubraving@...com>, <yhs@...com>, <kpsingh@...nel.org>,
        <netdev@...r.kernel.org>, <bpf@...r.kernel.org>
Subject: Re: [PATCH bpf-next v2 1/4] bpf, sockmap: Fix memleak in
 sk_psock_queue_msg


在 2022/3/3 8:41, Cong Wang 写道:
> On Wed, Mar 02, 2022 at 10:27:52AM +0800, Wang Yufen wrote:
>> diff --git a/include/linux/skmsg.h b/include/linux/skmsg.h
>> index fdb5375f0562..c5a2d6f50f25 100644
>> --- a/include/linux/skmsg.h
>> +++ b/include/linux/skmsg.h
>> @@ -304,21 +304,16 @@ static inline void sock_drop(struct sock *sk, struct sk_buff *skb)
>>   	kfree_skb(skb);
>>   }
>>   
>> -static inline void drop_sk_msg(struct sk_psock *psock, struct sk_msg *msg)
>> -{
>> -	if (msg->skb)
>> -		sock_drop(psock->sk, msg->skb);
>> -	kfree(msg);
>> -}
>> -
>>   static inline void sk_psock_queue_msg(struct sk_psock *psock,
>>   				      struct sk_msg *msg)
>>   {
>>   	spin_lock_bh(&psock->ingress_lock);
>>   	if (sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED))
>>   		list_add_tail(&msg->list, &psock->ingress_msg);
>> -	else
>> -		drop_sk_msg(psock, msg);
>> +	else {
>> +		sk_msg_free(psock->sk, msg);
> __sk_msg_free() calls sk_msg_init() at the end.
>
>> +		kfree(msg);
> Now you free it, hence the above sk_msg_init() is completely
> unnecessary.

Invoking of sk_msg_free() does not always follow kfree().

That is, sk_msg needs to be reused in some cases.

We can implement sk_msg_free_xx() without sk_msg_init(),

but I don't think it is necessary.


Thanks

>
> Thanks.
> .