Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 05dceb60 authored by Eric Dumazet's avatar Eric Dumazet Committed by Greg Kroah-Hartman
Browse files

net/packet: fix memory leak in packet_set_ring() 



[ Upstream commit 55655e3d1197fff16a7a05088fb0e5eba50eac55 ]

syzbot found we can leak memory in packet_set_ring(), if user application
provides buggy parameters.

Fixes: 7f953ab2 ("af_packet: TX_RING support for TPACKET_V3")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Cc: Sowmini Varadhan <sowmini.varadhan@oracle.com>
Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 7c92f3ef

net/packet/af_packet.c

+2 −1
Original line number Diff line number Diff line
@@ -4316,7 +4316,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, 
				    req3->tp_sizeof_priv ||

				    req3->tp_feature_req_word) {

					err = -EINVAL;

					goto out;

					goto out_free_pg_vec;

				}

			}

			break;
@@ -4380,6 +4380,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, 
			prb_shutdown_retire_blk_timer(po, rb_queue);

	}



out_free_pg_vec:

	if (pg_vec)

		free_pg_vec(pg_vec, order, req->tp_block_nr);

out: