Commit 47022bdc authored Jun 25, 2021 by Pavel Skripkin Committed by Lee Jones Mar 01, 2023

UPSTREAM: net: xfrm: fix memory leak in xfrm_user_rcv_msg



Syzbot reported memory leak in xfrm_user_rcv_msg(). The
problem was is non-freed skb's frag_list.

In skb_release_all() skb_release_data() will be called only
in case of skb->head != NULL, but netlink_skb_destructor()
sets head to NULL. So, allocated frag_list skb should be
freed manualy, since consume_skb() won't take care of it

Bug: 254441685
Fixes: 5106f4a8acff ("xfrm/compat: Add 32=>64-bit messages translator")
Reported-and-tested-by:  <syzbot+fb347cf82c73a90efcca@syzkaller.appspotmail.com>
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
(cherry picked from commit 7c1a80e80cde008f271bae630d28cf684351e807)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I095d86043b582d75eb9c2ef91a93eec44683676b

parent 9eabb09c

net/xfrm/xfrm_user.c

+10 −0

Original line number	Diff line number	Diff line
		@@ -2757,6 +2757,16 @@ static int xfrm_user_rcv_msg(struct sk_buff skb, struct nlmsghdr nlh,

		err = link->doit(skb, nlh, attrs);

		/* We need to free skb allocated in xfrm_alloc_compat() before
		* returning from this function, because consume_skb() won't take
		* care of frag_list since netlink destructor sets
		* sbk->head to NULL. (see netlink_skb_destructor())
		*/
		if (skb_has_frag_list(skb)) {
		kfree_skb(skb_shinfo(skb)->frag_list);
		skb_shinfo(skb)->frag_list = NULL;
		}

		err:
		kvfree(nlh64);
		return err;