No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Pavel Skripkin 2038cd15ea net: rds: fix memory leak in rds_recvmsg
[ Upstream commit 49bfcbfd989a8f1f23e705759a6bb099de2cff9f ]

Syzbot reported memory leak in rds. The problem
was in unputted refcount in case of error.

int rds_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
		int msg_flags)
{
...

	if (!rds_next_incoming(rs, &inc)) {
		...
	}

After this "if" inc refcount incremented and

	if (rds_cmsg_recv(inc, msg, rs)) {
		ret = -EFAULT;
		goto out;
	}
...
out:
	return ret;
}

in case of rds_cmsg_recv() fail the refcount won't be
decremented. And it's easy to see from ftrace log, that
rds_inc_addref() don't have rds_inc_put() pair in
rds_recvmsg() after rds_cmsg_recv()

 1)               |  rds_recvmsg() {
 1)   3.721 us    |    rds_inc_addref();
 1)   3.853 us    |    rds_message_inc_copy_to_user();
 1) + 10.395 us   |    rds_cmsg_recv();
 1) + 34.260 us   |  }

Fixes: bdbe6fbc6a ("RDS: recv.c")
Reported-and-tested-by: syzbot+5134cdf021c4ed5aaa5f@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Reviewed-by: Håkon Bugge <haakon.bugge@oracle.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-06-23 14:41:24 +02:00
arch kvm: LAPIC: Restore guard to prevent illegal APIC register access 2021-06-23 14:41:23 +02:00
block blk-mq: Swap two calls in blk_mq_exit_queue() 2021-05-19 10:08:30 +02:00
certs certs: Fix blacklist flag type confusion 2021-03-04 10:26:29 +01:00
crypto crypto: rng - fix crypto_rng_reset() refcounting when !CRYPTO_STATS 2021-05-11 14:04:15 +02:00
Documentation XArray: add xas_split 2021-06-10 13:37:14 +02:00
drivers vrf: fix maximum MTU 2021-06-23 14:41:24 +02:00
fs afs: Fix an IS_ERR() vs NULL check 2021-06-23 14:41:23 +02:00
include HID: usbhid: fix info leak in hid_submit_ctrl 2021-06-18 09:58:58 +02:00
init pid: take a reference when initializing cad_pid 2021-06-10 13:37:11 +02:00
ipc
kernel tracing: Correct the length check which causes memory corruption 2021-06-16 11:59:46 +02:00
lib lib/lz4: explicitly support in-place decompression 2021-06-10 13:37:16 +02:00
LICENSES
mm mm/memory-failure: make sure wait for page writeback in memory_failure 2021-06-23 14:41:23 +02:00
net net: rds: fix memory leak in rds_recvmsg 2021-06-23 14:41:24 +02:00
samples samples: vfio-mdev: fix error handing in mdpy_fb_probe() 2021-06-10 13:37:03 +02:00
scripts scripts: switch explicitly to Python 3 2021-05-22 11:38:30 +02:00
security security: commoncap: fix -Wstringop-overread warning 2021-05-11 14:04:16 +02:00
sound ASoC: sti-sas: add missing MODULE_DEVICE_TABLE 2021-06-16 11:59:33 +02:00
tools perf session: Correct buffer copying when peeking events 2021-06-16 11:59:45 +02:00
usr
virt KVM: arm64: Initialize VCPU mdcr_el2 before loading it 2021-05-22 11:38:30 +02:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile Linux 5.4.127 2021-06-18 09:59:00 +02:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.