linux

mirror of https://github.com/torvalds/linux.git synced 2026-06-08 14:42:37 +02:00

Linux kernel source tree

Go to file

Eric Biggers 3f3f7409f0 llc: fix sk_buff leak in llc_sap_state_process() commit `c6ee11c39f` upstream. syzbot reported: BUG: memory leak unreferenced object 0xffff888116270800 (size 224): comm "syz-executor641", pid 7047, jiffies 4294947360 (age 13.860s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 20 e1 2a 81 88 ff ff 00 40 3d 2a 81 88 ff ff . ......@=.... backtrace: [<000000004d41b4cc>] kmemleak_alloc_recursive include/linux/kmemleak.h:55 [inline] [<000000004d41b4cc>] slab_post_alloc_hook mm/slab.h:439 [inline] [<000000004d41b4cc>] slab_alloc_node mm/slab.c:3269 [inline] [<000000004d41b4cc>] kmem_cache_alloc_node+0x153/0x2a0 mm/slab.c:3579 [<00000000506a5965>] __alloc_skb+0x6e/0x210 net/core/skbuff.c:198 [<000000001ba5a161>] alloc_skb include/linux/skbuff.h:1058 [inline] [<000000001ba5a161>] alloc_skb_with_frags+0x5f/0x250 net/core/skbuff.c:5327 [<0000000047d9c78b>] sock_alloc_send_pskb+0x269/0x2a0 net/core/sock.c:2225 [<000000003828fe54>] sock_alloc_send_skb+0x32/0x40 net/core/sock.c:2242 [<00000000e34d94f9>] llc_ui_sendmsg+0x10a/0x540 net/llc/af_llc.c:933 [<00000000de2de3fb>] sock_sendmsg_nosec net/socket.c:652 [inline] [<00000000de2de3fb>] sock_sendmsg+0x54/0x70 net/socket.c:671 [<000000008fe16e7a>] __sys_sendto+0x148/0x1f0 net/socket.c:1964 [...] The bug is that llc_sap_state_process() always takes an extra reference to the skb, but sometimes neither llc_sap_next_state() nor llc_sap_state_process() itself drops this reference. Fix it by changing llc_sap_next_state() to never consume a reference to the skb, rather than sometimes do so and sometimes not. Then remove the extra skb_get() and kfree_skb() from llc_sap_state_process(). Reported-by: syzbot+6bf095f9becf5efef645@syzkaller.appspotmail.com Reported-by: syzbot+31c16aa4202dace3812e@syzkaller.appspotmail.com Fixes: `1da177e4c3` ("Linux-2.6.12-rc2") Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2019-11-06 13:06:23 +01:00
arch	arm64: Ensure VM_WRITE\|VM_SHARED ptes are clean by default	2019-11-06 13:06:21 +01:00
block	blk-rq-qos: fix first node deletion of rq_qos_del()	2019-10-29 09:20:09 +01:00
certs	export.h: remove VMLINUX_SYMBOL() and VMLINUX_SYMBOL_STR()	2018-08-22 23:21:44 +09:00
crypto	crypto: skcipher - Unmap pages after an external error	2019-10-11 18:20:52 +02:00
Documentation	x86/xen: Return from panic notifier	2019-11-06 13:05:55 +01:00
drivers	drm/amdgpu/powerplay/vega10: allow undervolting in p7	2019-11-06 13:06:22 +01:00
firmware	kbuild: remove all dummy assignments to obj-	2017-11-18 11:46:06 +09:00
fs	NFS: Fix an RCU lock leak in nfs4_refresh_delegation_stateid()	2019-11-06 13:06:22 +01:00
include	btrfs: tracepoints: Fix bad entry members of qgroup events	2019-10-29 09:20:07 +01:00
init	initramfs: don't free a non-existent initrd	2019-10-01 08:26:09 +02:00
ipc	ipc/mqueue.c: only perform resource calculation if user valid	2019-08-06 19:06:52 +02:00
kernel	tracing: Initialize iter->seq after zeroing in tracing_read_pipe()	2019-11-06 13:06:09 +01:00
lib	lib: textsearch: fix escapes in example code	2019-10-29 09:19:35 +01:00
LICENSES	LICENSES: Remove CC-BY-SA-4.0 license text	2018-10-18 11:28:50 +02:00
mm	mm/memory-failure: poison read receives SIGKILL instead of SIGBUS if mmaped more than once	2019-10-29 09:19:59 +01:00
net	llc: fix sk_buff leak in llc_sap_state_process()	2019-11-06 13:06:23 +01:00
samples	samples: bpf: fix: seg fault with NULL pointer arg	2019-11-06 13:05:30 +01:00
scripts	scripts/setlocalversion: Improve -dirty check with git-status --no-optional-locks	2019-11-06 13:05:27 +01:00
security	ima: fix freeing ongoing ahash_request	2019-10-11 18:21:11 +02:00
sound	ALSA: hda/realtek - Add support for ALC623	2019-11-06 13:06:15 +01:00
tools	perf annotate: Return appropriate error code for allocation failures	2019-11-06 13:05:44 +01:00
usr	kbuild: clean compressed initramfs image	2019-10-07 18:57:16 +02:00
virt	KVM: coalesced_mmio: add bounds checking	2019-09-21 07:16:44 +02:00
.clang-format	clang-format: Set IndentWrappedFunctionNames false	2018-08-01 18:38:51 +02:00
.cocciconfig
.get_maintainer.ignore
.gitattributes	.gitattributes: set git diff driver for C source code files	2016-10-07 18:46:30 -07:00
.gitignore	Kbuild updates for v4.17 (2nd)	2018-04-15 17:21:30 -07:00
.mailmap	libnvdimm-for-4.19_misc	2018-08-25 18:13:10 -07:00
COPYING	COPYING: use the new text with points to the license files	2018-03-23 12:41:45 -06:00
CREDITS	9p: remove Ron Minnich from MAINTAINERS	2018-08-17 16:20:26 -07:00
Kbuild	Kbuild updates for v4.15	2017-11-17 17:45:29 -08:00
Kconfig	kconfig: move the "Executable file formats" menu to fs/Kconfig.binfmt	2018-08-02 08:06:55 +09:00
MAINTAINERS	USB: rio500: Remove Rio 500 kernel driver	2019-10-17 13:44:47 -07:00
Makefile	Linux 4.19.81	2019-10-29 09:20:09 +01:00
README	Docs: Added a pointer to the formatted docs to README	2018-03-21 09:02:53 -06:00

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.
See Documentation/00-INDEX for a list of what is contained in each file.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.