Received: by 2002:a05:6a10:206:0:0:0:0 with SMTP id 6csp3924374pxj; Mon, 21 Jun 2021 09:29:05 -0700 (PDT) X-Google-Smtp-Source: ABdhPJz1ylEQzevIoT4PRyfH/TkIQFjYXi4USXWKq135rnn86iVyYf4tQbw9rozSfxWTZ00eAJTS X-Received: by 2002:aa7:d812:: with SMTP id v18mr10219700edq.159.1624292945706; Mon, 21 Jun 2021 09:29:05 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1624292945; cv=none; d=google.com; s=arc-20160816; b=zuIzBOHi+CfO1WWqcMuNhZNhKnYtryETVQ4Z1Usg10AlPdeyHpUIO2+ROeecpLVV3v LR4fYLCBWe4jrAlwBr64mZxXjX5MBXaa0wCa9/L2HWqgxgWcO1jD/my7QfwfH1NffYGN cHJgIFzvNSK4n7ERPL3CXfPOWPM+zVzMeknVHWQK5dTYZaWPWti3typGhLATTNu7masV 7gLW17uW7/SnlaF6Y1NJTAh+acn8Q1B8k8HYJOutUNI6pQXoo7rH6SFW8owQp5HKPxc0 4Cf8YFqYaidz/AkKbMH2TzIuQMIyPqutIXleSNfNmR9O+FCFf1SQOpwATP2/I4380vF7 XmCg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=FwwNSn1+IsFjo1qJsVviFYssv5r7TdwTkmicWPrCKSQ=; b=jEM4SYMbp8/3X5c+VspZCSAiBHy1T5Y9jfGX9JIYPNalMP0wBLofOaCW0dUDq4sYlQ fvyfN6nequi5GlAtW7fnNdua6C+ZlBlY2wc3aq2uEhxgenSQxKbFPQmteTaUmGRe1lGq PQsLlAHzt9cYavkQHx+Pa17JuzL4d+3rQtcZOGZ1fosZWN7UKhvPhFSWAz8Cw1JjDBkM 72+U9JcYfn0CzlN5YQEaE/omic2yK8fXEnF/qmq9JUp21XtVY5NgrwEJ5TihNI9ywstB AG7Ce2jz76YKDTbywM3DCabLV/cuAynsBrCpZsjnjNdpO/+VcBO2Wq8oM4rQIZRycsq9 Q+NA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=Tj2BbEGL; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id jg29si10848784ejc.268.2021.06.21.09.28.41; Mon, 21 Jun 2021 09:29:05 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=Tj2BbEGL; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232132AbhFUQ35 (ORCPT + 99 others); Mon, 21 Jun 2021 12:29:57 -0400 Received: from mail.kernel.org ([198.145.29.99]:46838 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231162AbhFUQ2J (ORCPT ); Mon, 21 Jun 2021 12:28:09 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id A56C0613BA; Mon, 21 Jun 2021 16:23:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1624292598; bh=lNfDjPhhfB4yjGG7SUymDWseI5BRKBUwphpFwJAfbK0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Tj2BbEGL4PiMYL/v3bWzB436btIp72tqZocQH6WMibMX46FtMHd0UFbXvCNZydDl0 6btGH+iLFQ1ImWMQ3gtk872W2e4NyNOj/fQgQeBJzWt9RQihr7aFbdqKRGTdjf7iWJ Yw50PSjk1379i+uCHTb2mW/5Hao4aNh2aJzi5Bao= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hulk Robot , Chengyang Fan , Hangbin Liu , "David S. Miller" , Sasha Levin Subject: [PATCH 5.10 060/146] net: ipv4: fix memory leak in ip_mc_add1_src Date: Mon, 21 Jun 2021 18:14:50 +0200 Message-Id: <20210621154914.453267886@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210621154911.244649123@linuxfoundation.org> References: <20210621154911.244649123@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Chengyang Fan [ Upstream commit d8e2973029b8b2ce477b564824431f3385c77083 ] BUG: memory leak unreferenced object 0xffff888101bc4c00 (size 32): comm "syz-executor527", pid 360, jiffies 4294807421 (age 19.329s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 01 00 00 00 00 00 00 00 ac 14 14 bb 00 00 02 00 ................ backtrace: [<00000000f17c5244>] kmalloc include/linux/slab.h:558 [inline] [<00000000f17c5244>] kzalloc include/linux/slab.h:688 [inline] [<00000000f17c5244>] ip_mc_add1_src net/ipv4/igmp.c:1971 [inline] [<00000000f17c5244>] ip_mc_add_src+0x95f/0xdb0 net/ipv4/igmp.c:2095 [<000000001cb99709>] ip_mc_source+0x84c/0xea0 net/ipv4/igmp.c:2416 [<0000000052cf19ed>] do_ip_setsockopt net/ipv4/ip_sockglue.c:1294 [inline] [<0000000052cf19ed>] ip_setsockopt+0x114b/0x30c0 net/ipv4/ip_sockglue.c:1423 [<00000000477edfbc>] raw_setsockopt+0x13d/0x170 net/ipv4/raw.c:857 [<00000000e75ca9bb>] __sys_setsockopt+0x158/0x270 net/socket.c:2117 [<00000000bdb993a8>] __do_sys_setsockopt net/socket.c:2128 [inline] [<00000000bdb993a8>] __se_sys_setsockopt net/socket.c:2125 [inline] [<00000000bdb993a8>] __x64_sys_setsockopt+0xba/0x150 net/socket.c:2125 [<000000006a1ffdbd>] do_syscall_64+0x40/0x80 arch/x86/entry/common.c:47 [<00000000b11467c4>] entry_SYSCALL_64_after_hwframe+0x44/0xae In commit 24803f38a5c0 ("igmp: do not remove igmp souce list info when set link down"), the ip_mc_clear_src() in ip_mc_destroy_dev() was removed, because it was also called in igmpv3_clear_delrec(). Rough callgraph: inetdev_destroy -> ip_mc_destroy_dev -> igmpv3_clear_delrec -> ip_mc_clear_src -> RCU_INIT_POINTER(dev->ip_ptr, NULL) However, ip_mc_clear_src() called in igmpv3_clear_delrec() doesn't release in_dev->mc_list->sources. And RCU_INIT_POINTER() assigns the NULL to dev->ip_ptr. As a result, in_dev cannot be obtained through inetdev_by_index() and then in_dev->mc_list->sources cannot be released by ip_mc_del1_src() in the sock_close. Rough call sequence goes like: sock_close -> __sock_release -> inet_release -> ip_mc_drop_socket -> inetdev_by_index -> ip_mc_leave_src -> ip_mc_del_src -> ip_mc_del1_src So we still need to call ip_mc_clear_src() in ip_mc_destroy_dev() to free in_dev->mc_list->sources. Fixes: 24803f38a5c0 ("igmp: do not remove igmp souce list info ...") Reported-by: Hulk Robot Signed-off-by: Chengyang Fan Acked-by: Hangbin Liu Signed-off-by: David S. Miller Signed-off-by: Sasha Levin --- net/ipv4/igmp.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c index 7b272bbed2b4..6b3c558a4f23 100644 --- a/net/ipv4/igmp.c +++ b/net/ipv4/igmp.c @@ -1801,6 +1801,7 @@ void ip_mc_destroy_dev(struct in_device *in_dev) while ((i = rtnl_dereference(in_dev->mc_list)) != NULL) { in_dev->mc_list = i->next_rcu; in_dev->mc_count--; + ip_mc_clear_src(i); ip_ma_put(i); } } -- 2.30.2