Patchwork [v2] packet: fix leakage of tx_ring memory

login
register
mail settings
Submitter Phil Sutter
Date Feb. 1, 2013, 5:21 p.m.
Message ID <1359739301-14044-1-git-send-email-phil.sutter@viprinet.com>
Download mbox | patch
Permalink /patch/217541/
State Accepted
Delegated to: David Miller
Headers show

Comments

Phil Sutter - Feb. 1, 2013, 5:21 p.m.
When releasing a packet socket, the routine packet_set_ring() is reused
to free rings instead of allocating them. But when calling it for the
first time, it fills req->tp_block_nr with the value of rb->pg_vec_len
which in the second invocation makes it bail out since req->tp_block_nr
is greater zero but req->tp_block_size is zero.

This patch solves the problem by passing a zeroed auto-variable to
packet_set_ring() upon each invocation from packet_release().

As far as I can tell, this issue exists even since 69e3c75 (net: TX_RING
and packet mmap), i.e. the original inclusion of TX ring support into
af_packet, but applies only to sockets with both RX and TX ring
allocated, which is probably why this was unnoticed all the time.

Signed-off-by: Phil Sutter <phil.sutter@viprinet.com>
Cc: Johann Baudy <johann.baudy@gnu-log.net>
Cc: Daniel Borkmann <dborkman@redhat.com>

---
Changes since v1:
- less functions
- more code duplication
---
 net/packet/af_packet.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)
Daniel Borkmann - Feb. 1, 2013, 5:25 p.m.
On 02/01/2013 06:21 PM, Phil Sutter wrote:
> When releasing a packet socket, the routine packet_set_ring() is reused
> to free rings instead of allocating them. But when calling it for the
> first time, it fills req->tp_block_nr with the value of rb->pg_vec_len
> which in the second invocation makes it bail out since req->tp_block_nr
> is greater zero but req->tp_block_size is zero.
>
> This patch solves the problem by passing a zeroed auto-variable to
> packet_set_ring() upon each invocation from packet_release().
>
> As far as I can tell, this issue exists even since 69e3c75 (net: TX_RING
> and packet mmap), i.e. the original inclusion of TX ring support into
> af_packet, but applies only to sockets with both RX and TX ring
> allocated, which is probably why this was unnoticed all the time.
>
> Signed-off-by: Phil Sutter <phil.sutter@viprinet.com>
> Cc: Johann Baudy <johann.baudy@gnu-log.net>
> Cc: Daniel Borkmann <dborkman@redhat.com>

Acked-by: Daniel Borkmann <dborkman@redhat.com>
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
David Miller - Feb. 3, 2013, 9:15 p.m.
From: Daniel Borkmann <dborkman@redhat.com>
Date: Fri, 01 Feb 2013 18:25:13 +0100

> On 02/01/2013 06:21 PM, Phil Sutter wrote:
>> When releasing a packet socket, the routine packet_set_ring() is
>> reused
>> to free rings instead of allocating them. But when calling it for the
>> first time, it fills req->tp_block_nr with the value of rb->pg_vec_len
>> which in the second invocation makes it bail out since
>> req->tp_block_nr
>> is greater zero but req->tp_block_size is zero.
>>
>> This patch solves the problem by passing a zeroed auto-variable to
>> packet_set_ring() upon each invocation from packet_release().
>>
>> As far as I can tell, this issue exists even since 69e3c75 (net:
>> TX_RING
>> and packet mmap), i.e. the original inclusion of TX ring support into
>> af_packet, but applies only to sockets with both RX and TX ring
>> allocated, which is probably why this was unnoticed all the time.
>>
>> Signed-off-by: Phil Sutter <phil.sutter@viprinet.com>
>> Cc: Johann Baudy <johann.baudy@gnu-log.net>
>> Cc: Daniel Borkmann <dborkman@redhat.com>
> 
> Acked-by: Daniel Borkmann <dborkman@redhat.com>

Applied and queued up for -stable, thanks.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index a91fd0b..07c9483 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2364,13 +2364,15 @@  static int packet_release(struct socket *sock)
 
 	packet_flush_mclist(sk);
 
-	memset(&req_u, 0, sizeof(req_u));
-
-	if (po->rx_ring.pg_vec)
+	if (po->rx_ring.pg_vec) {
+		memset(&req_u, 0, sizeof(req_u));
 		packet_set_ring(sk, &req_u, 1, 0);
+	}
 
-	if (po->tx_ring.pg_vec)
+	if (po->tx_ring.pg_vec) {
+		memset(&req_u, 0, sizeof(req_u));
 		packet_set_ring(sk, &req_u, 1, 1);
+	}
 
 	fanout_release(sk);