Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Santosh Shilimkar <santosh.shilimkar@oracle.com>
To:     Pavel Skripkin <paskripkin@gmail.com>
CC:     "David S. Miller" <davem@davemloft.net>,
        "kuba@kernel.org" <kuba@kernel.org>,
        "netdev@vger.kernel.org" <netdev@vger.kernel.org>,
        "linux-rdma@vger.kernel.org" <linux-rdma@vger.kernel.org>,
        "rds-devel@oss.oracle.com" <rds-devel@oss.oracle.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "syzbot+5134cdf021c4ed5aaa5f@syzkaller.appspotmail.com" 
        <syzbot+5134cdf021c4ed5aaa5f@syzkaller.appspotmail.com>
Subject: Re: [PATCH v2] net: rds: fix memory leak in rds_recvmsg
Thread-Topic: [PATCH v2] net: rds: fix memory leak in rds_recvmsg
Thread-Index: AQHXXHRjHk4wgQwXQUuKHUobVcZ1xA==
Date:   Tue, 8 Jun 2021 14:41:38 +0000
Message-ID: <56870339-B19F-41D4-8A92-BECB2EAC5646@oracle.com>
References: <CF68E17D-CC8A-4B30-9B67-4A0B0047FCE1@oracle.com>
 <20210608080641.16543-1-paskripkin@gmail.com>
In-Reply-To: <20210608080641.16543-1-paskripkin@gmail.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?PTcHDzLAmOErubH4f9nfAkz9dr72r0UykK5FQ5OBmOGKJjZXA9Fow2Gu9kwf?=
 =?us-ascii?Q?Qfv+NeLByhS+DyZLKoURk2bG0T4AlxcVVIukzYQlkHl8dM1aOmSPddgYOzzC?=
 =?us-ascii?Q?KkJCzyY5Lfk+n1eUfgjxA4HU8hK6gsVJ6UqVvTt1ckkGE22BBZ6/pz1g2Tau?=
 =?us-ascii?Q?lkKa38qY+JcZ4bvq2OZBPulLZ+dvWrzrfDL+Aq9HNxQ7BhEee2OEotbePEZZ?=
 =?us-ascii?Q?ebxzqbmiuG1+n3WieLG5yHDnYs/FKQYtzLdWJl9q9HzYMdgXDawDmfZ2vfyO?=
 =?us-ascii?Q?hMNdA143XbeIvHFJd0lFpVVvaiGri+dUW0es1vwHNmUHpfvcbdUWrA1VTTwa?=
 =?us-ascii?Q?fRfj1EBOr9a2Mg6zY1F9LfH+wdM0exdvZBUqqeDxcTWcL4efKDuITN3A5bLx?=
 =?us-ascii?Q?6SPFOoyQ6ERkImUEk6Ulnjs1YxtU0KxucdPDXpsWb0oK/a6cbfn6oa9ug+lc?=
 =?us-ascii?Q?kcnf01MaLxRx04+ouSQfOU5LQPfFsnmS4o9NQwUYriqySJ8NINlyFyyp8/6m?=
 =?us-ascii?Q?QMr2GPAtMDlQ2fS9KkiyGgohC1mkmBcByy7u26q6KBObd4r20ctk+Sjt2PPC?=
 =?us-ascii?Q?aKFGmtBKbL+2smQI70S3/BcEa7rjlPcvgg4c7f8/9tnAlXOf2qkqY6DDIOSs?=
 =?us-ascii?Q?lC2aVwJc3ymmX+KfDP7RaONIYHB4zA36c37rLhH+2O0ZTyyeSNa16VD0z+j6?=
 =?us-ascii?Q?r1je9y7ehxkZGLx646ftRUnf8Itu+YPmeDMztsxOUJXZqPlVRbzp9LZTIwi4?=
 =?us-ascii?Q?k49HDMP4NRm1cvft2emnciVO6KGp1HQArM3CRa6YImp8YFgQQ7/q1sdVD/L+?=
 =?us-ascii?Q?BM1TfhB/12eqDhrE/5uOAAbHX0zjZvNmWPHh8g7tpkmvaTN95OPPfXmi6I5i?=
 =?us-ascii?Q?V+NWh9x660MWl9tbZoVtdtT5XbY9WgYxacuxiYaE/WANHR2bG1/u0xZFqVRB?=
 =?us-ascii?Q?G8+3c9Zxlou/hQs2s+G9bu7/2hjb4aMWxeKfgg16AetNwI8TnfeNVoEx/bfq?=
 =?us-ascii?Q?JiNOlzemSj3Q4o3Y57OP8nRNllAMtTkZM3Tcvsk9mlJOpcN4kQPTXKq+uemJ?=
 =?us-ascii?Q?uDxGmGlCot0sNGzQRpbv8wtdudvV2n0MoFbvbA1OQjtNuDlYoirpE/syjVQO?=
 =?us-ascii?Q?11FP7A4gbrnyiZeUvjFoNFeMh/QaUvsn6gxyQM82eSd27gNsmaE5P+Zwoe+1?=
 =?us-ascii?Q?t6mspRP31f2M10a7GopkTw8nFuwgKqBbE/SkKcy7as4WgfP0Je/zy5GuBUIo?=
 =?us-ascii?Q?1WmU71U1ESYNe+iwb4fU871BRvt2c/PIDC7v7uqnQizsAwKzOqwJu9lLnXPp?=
 =?us-ascii?Q?BXY/HoMBXC24G12Me6QR7dvv?=
Content-Type: text/plain; charset="us-ascii"
Content-ID: <4A128030DDB73846818FF8EF4F905252@namprd10.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: BYAPR10MB3270.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: ce11e02b-9d75-4386-e9dd-08d92a8b85ac
X-MS-Exchange-CrossTenant-originalarrivaltime: 08 Jun 2021 14:41:38.0668
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: b/3RDkZ8V2nOJUQxsZufinnKmrq2fdjoYm/HZraVoo8wF3vXyTjznPEUlgORPbQ/DiyxXTSYHeUZ5lDjUiS2su3fN1+5d2P0N79X3/0Lmfk=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR10MB3270
X-Proofpoint-Virus-Version: vendor=nai engine=6200 definitions=10009 signatures=668682
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 phishscore=0 bulkscore=0 mlxscore=0
 spamscore=0 adultscore=0 mlxlogscore=999 suspectscore=0 malwarescore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2104190000
 definitions=main-2106080094
X-Proofpoint-ORIG-GUID: ZGmTBR02F7JYeeR5Ra94LSW1iZrDJxEh
X-Proofpoint-GUID: ZGmTBR02F7JYeeR5Ra94LSW1iZrDJxEh
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Jun 8, 2021, at 1:06 AM, Pavel Skripkin <paskripkin@gmail.com> wrote:
>=20
> Syzbot reported memory leak in rds. The problem
> was in unputted refcount in case of error.
>=20
> int rds_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
> 		int msg_flags)
> {
> ...
>=20
> 	if (!rds_next_incoming(rs, &inc)) {
> 		...
> 	}
>=20
> After this "if" inc refcount incremented and
>=20
> 	if (rds_cmsg_recv(inc, msg, rs)) {
> 		ret =3D -EFAULT;
> 		goto out;
> 	}
> ...
> out:
> 	return ret;
> }
>=20
> in case of rds_cmsg_recv() fail the refcount won't be
> decremented. And it's easy to see from ftrace log, that
> rds_inc_addref() don't have rds_inc_put() pair in
> rds_recvmsg() after rds_cmsg_recv()
>=20
> 1)               |  rds_recvmsg() {
> 1)   3.721 us    |    rds_inc_addref();
> 1)   3.853 us    |    rds_message_inc_copy_to_user();
> 1) + 10.395 us   |    rds_cmsg_recv();
> 1) + 34.260 us   |  }
>=20
> Fixes: bdbe6fbc6a2f ("RDS: recv.c")
> Reported-and-tested-by: syzbot+5134cdf021c4ed5aaa5f@syzkaller.appspotmail=
.com
> Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
> ---
>=20
> Changes in v2:
> 	Changed goto to break.
>=20
Looks fine by me. Thanks for the fix.

Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>