lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <2023052208-squad-viper-b244@gregkh> Date: Mon, 22 May 2023 18:08:21 +0100 From: Greg KH <gregkh@...uxfoundation.org> To: Pratyush Yadav <ptyadav@...zon.de> Cc: SeongJae Park <sj@...nel.org>, "David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, Kuniyuki Iwashima <kuniyu@...zon.com>, Willem de Bruijn <willemb@...gle.com>, Norbert Manthey <nmanthey@...zon.de>, netdev@...r.kernel.org, linux-kernel@...r.kernel.org, stable@...r.kernel.org Subject: Re: [PATCH net] net: fix skb leak in __skb_tstamp_tx() On Mon, May 22, 2023 at 07:03:59PM +0200, Pratyush Yadav wrote: > On Mon, May 22 2023, SeongJae Park wrote: > > > Hi Pratyush, > > > > On Mon, 22 May 2023 17:30:20 +0200 Pratyush Yadav <ptyadav@...zon.de> wrote: > > > >> Commit 50749f2dd685 ("tcp/udp: Fix memleaks of sk and zerocopy skbs with > >> TX timestamp.") added a call to skb_orphan_frags_rx() to fix leaks with > >> zerocopy skbs. But it ended up adding a leak of its own. When > >> skb_orphan_frags_rx() fails, the function just returns, leaking the skb > >> it just cloned. Free it before returning. > >> > >> This bug was discovered and resolved using Coverity Static Analysis > >> Security Testing (SAST) by Synopsys, Inc. > >> > >> Fixes: 50749f2dd685 ("tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp.") > > > > Seems the commit has merged in several stable kernels. Is the bug also > > affecting those? If so, would it be better to Cc stable@...r.kernel.org? > > > > It affects v5.4.243 at least, since that is where I first saw this. But > I would expect it to affect other stable kernels it has been backported > to as well. I thought using the Fixes tag pointing to the bad upstream > commit would be enough for the stable maintainers' tooling/bots to pick > this patch up. > > In either case, +Cc stable. Link to the patch this thread is talking > about [0]. <formletter> This is not the correct way to submit patches for inclusion in the stable kernel tree. Please read: https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html for how to do this properly. </formletter>
Powered by blists - more mailing lists