Magnus Karlsson 0fae7d269e xsk: Fix memory leak for failed bind ... commit 8bee683384 upstream. Fix a possible memory leak when a bind of an AF_XDP socket fails. When the fill and completion rings are created, they are tied to the socket. But when the buffer pool is later created at bind time, the ownership of these two rings are transferred to the buffer pool as they might be shared between sockets (and the buffer pool cannot be created until we know what we are binding to). So, before the buffer pool is created, these two rings are cleaned up with the socket, and after they have been transferred they are cleaned up together with the buffer pool. The problem is that ownership was transferred before it was absolutely certain that the buffer pool could be created and initialized correctly and when one of these errors occurred, the fill and completion rings did neither belong to the socket nor the pool and where therefore leaked. Solve this by moving the ownership transfer to the point where the buffer pool has been completely set up and there is no way it can fail. Fixes: 7361f9c3d7 ("xsk: Move fill and completion rings to buffer pool") Reported-by: syzbot+cfa88ddd0655afa88763@syzkaller.appspotmail.com Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Björn Töpel <bjorn.topel@intel.com> Link: https://lore.kernel.org/bpf/20201214085127.3960-1-magnus.karlsson@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-01-12 20:18:26 +01:00
..
Kconfig	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
Makefile	xsk: Introduce AF_XDP buffer allocation API	2020-05-21 17:31:26 -07:00
xdp_umem.c	xsk: Fix umem cleanup bug at socket destruct	2020-11-20 15:52:39 +01:00
xdp_umem.h	xsk: Fix umem cleanup bug at socket destruct	2020-11-20 15:52:39 +01:00
xsk_buff_pool.c	xsk: Fix memory leak for failed bind	2021-01-12 20:18:26 +01:00
xsk_diag.c	xsk: Fix possible segfault in xsk umem diagnostics	2020-09-02 16:49:40 +02:00
xsk_queue.c	xsk: Remove MEM_TYPE_ZERO_COPY and corresponding code	2020-05-21 17:31:27 -07:00
xsk_queue.h	xsk: Change the tx writeable condition	2020-12-03 01:14:38 +01:00
xsk.c	xsk: Fix memory leak for failed bind	2021-01-12 20:18:26 +01:00
xsk.h	xsk: Fix possible segfault at xskmap entry insertion	2020-09-02 16:52:59 +02:00
xskmap.c	bpf: Allow for map-in-map with dynamic inner array map entries	2020-10-11 10:21:04 -07:00