Jakub Sitnicki
8f73ac0b64
bpf, sockhash: Fix memory leak when unlinking sockets in sock_hash_free ...
[ Upstream commit 33a7c831565c43a7ee2f38c7df4c4a40e1dfdfed ]
When sockhash gets destroyed while sockets are still linked to it, we will
walk the bucket lists and delete the links. However, we are not freeing the
list elements after processing them, leaking the memory.
The leak can be triggered by close()'ing a sockhash map when it still
contains sockets, and observed with kmemleak:
unreferenced object 0xffff888116e86f00 (size 64):
comm "race_sock_unlin", pid 223, jiffies 4294731063 (age 217.404s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
81 de e8 41 00 00 00 00 c0 69 2f 15 81 88 ff ff ...A.....i/.....
backtrace:
[<00000000dd089ebb>] sock_hash_update_common+0x4ca/0x760
[<00000000b8219bd5>] sock_hash_update_elem+0x1d2/0x200
[<000000005e2c23de>] __do_sys_bpf+0x2046/0x2990
[<00000000d0084618>] do_syscall_64+0xad/0x9a0
[<000000000d96f263>] entry_SYSCALL_64_after_hwframe+0x49/0xb3
Fix it by freeing the list element when we're done with it.
Fixes: 604326b41ahttps://lore.kernel.org/bpf/20200607205229.2389672-2-jakub@cloudflare.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-06-24 17:50:19 +02:00
vlan: vlan_changelink() should propagate errors
2020-01-12 12:21:50 +01:00
ax25: fix setsockopt(SO_BINDTODEVICE)
2020-06-03 08:20:39 +02:00
batman-adv: Revert "disable ethtool link speed detection when auto negotiation off"
2020-06-22 09:30:56 +02:00
Bluetooth: Add SCO fallback for invalid LMP parameters error
2020-06-22 09:30:54 +02:00
net/bpfilter: remove superfluous testing message
2020-04-21 09:04:53 +02:00
bridge: Avoid infinite loop when suppressing NS messages with invalid options
2020-06-17 16:40:20 +02:00
can: j1939: j1939_sk_bind(): take priv after lock is held
2019-12-31 16:45:56 +01:00
libceph: ignore pool overlay and cache logic on redirects
2020-06-03 08:21:25 +02:00
bpf, sockhash: Fix memory leak when unlinking sockets in sock_hash_free
2020-06-24 17:50:19 +02:00
dccp: Fix possible memleak in dccp_init and dccp_fini
2020-06-17 16:40:32 +02:00
net: add bool confirm_neigh parameter for dst_ops.update_pmtu
2020-01-04 19:18:58 +01:00
KEYS: Don't write out to userspace while holding key semaphore
2020-04-23 10:36:45 +02:00
net: dsa: declare lockless TX feature for slave ports
2020-06-03 08:21:38 +02:00
net: add annotations on hh->hh_len lockless accesses
2020-01-09 10:20:06 +01:00
hsr: check protocol version in hsr_newlink()
2020-04-21 09:04:44 +02:00
nl802154: add missing attribute validation for dev_type
2020-03-18 07:17:44 +01:00
ipv4: fix a RCU-list lock in fib_triestat_seq_show
2020-06-17 16:40:24 +02:00
ipv6: fix IPV6_ADDRFORM operation logic
2020-06-17 16:40:19 +02:00
l2tp: do not use inet_hash()/inet_unhash()
2020-06-10 20:24:54 +02:00
llc2: Fix return statement of llc_stat_ev_rx_null_dsap_xid_c (and _test_c)
2020-01-12 12:21:45 +01:00
mac80211: mesh: fix discovery timer re-arming issue / crash
2020-06-03 08:21:30 +02:00
netfilter: nft_nat: return EOPNOTSUPP if type or flags are not supported
2020-06-22 09:31:00 +02:00
netlabel: cope with NULL catmap
2020-05-20 08:20:08 +02:00
netlink: Use netlink header as base to calculate bad attribute offset
2020-03-18 07:17:40 +01:00
net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node
2020-04-29 16:33:08 +02:00
nfc: add missing attribute validation for vendor subcommand
2020-03-18 07:17:46 +01:00
net: openvswitch: ovs_ct_exit to be done under ovs_lock
2020-04-29 16:33:08 +02:00
net/packet: tpacket_rcv: avoid a producer race condition
2020-04-01 11:01:35 +02:00
net: qrtr: Fix passing invalid reference to qrtr_local_enqueue()
2020-06-03 08:21:00 +02:00
net/rds: Use ERR_PTR for rds_message_alloc_sgs()
2020-05-20 08:20:27 +02:00
rfkill: Fix incorrect check to avoid NULL pointer dereference
2020-01-12 12:21:33 +01:00
rxrpc: Fix ack discard
2020-05-27 17:46:51 +02:00
net_sched: fix tcm_parent in tc filter dump
2020-05-20 08:20:07 +02:00
sctp: fix refcount bug in sctp_wfree
2020-06-17 16:40:24 +02:00
net/smc: cancel event worker during device removal
2020-03-18 07:17:59 +01:00
sunrpc: clean up properly in gss_mech_unregister()
2020-06-22 09:31:24 +02:00
tipc: block BH before using dst_cache
2020-06-03 08:21:03 +02:00
bpf: Fix running sk_skb program types with ktls
2020-06-22 09:31:12 +02:00
af_unix: add compat_ioctl support
2020-01-17 19:48:52 +01:00
vsock: fix timeout in vsock_accept()
2020-06-10 20:24:55 +02:00
cfg80211: fix debugfs rename crash
2020-06-03 08:21:29 +02:00
net/x25: Fix x25_neigh refcnt leak when receiving frame
2020-04-29 16:33:09 +02:00
xsk: Add overflow check for u64 division, stored into u32
2020-06-03 08:21:36 +02:00
xfrm: fix a NULL-ptr deref in xfrm_local_error
2020-06-03 08:21:33 +02:00
net: Fix CONFIG_NET_CLS_ACT=n and CONFIG_NFT_FWD_NETDEV={y, m} build
2020-04-01 11:02:18 +02:00
compat_ioctl: handle SIOCOUTQNSD
2020-01-17 19:48:52 +01:00
8f73ac0b64