From patchwork Fri Feb 1 17:21:41 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Phil Sutter X-Patchwork-Id: 217541 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 1442F2C0294 for ; Sat, 2 Feb 2013 04:22:17 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757138Ab3BARWM (ORCPT ); Fri, 1 Feb 2013 12:22:12 -0500 Received: from zimbra.vipri.net ([89.207.250.15]:36582 "EHLO zimbra.vipri.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757099Ab3BARWL (ORCPT ); Fri, 1 Feb 2013 12:22:11 -0500 Received: from localhost (localhost [127.0.0.1]) by zimbra.vipri.net (Postfix) with ESMTP id 3CB741000313; Fri, 1 Feb 2013 18:18:47 +0100 (CET) X-Virus-Scanned: amavisd-new at zimbra.vipri.net Received: from zimbra.vipri.net ([127.0.0.1]) by localhost (zimbra.vipri.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fRQmel2NFx97; Fri, 1 Feb 2013 18:18:47 +0100 (CET) Received: from phil.computerman.de (host-089-207-255-234.vipri.net [89.207.255.234]) by zimbra.vipri.net (Postfix) with ESMTPSA id 9A85B10001F4; Fri, 1 Feb 2013 18:18:46 +0100 (CET) From: Phil Sutter To: "David S. Miller" Cc: netdev@vger.kernel.org, Johann Baudy , Daniel Borkmann Subject: [PATCH v2] packet: fix leakage of tx_ring memory Date: Fri, 1 Feb 2013 18:21:41 +0100 Message-Id: <1359739301-14044-1-git-send-email-phil.sutter@viprinet.com> X-Mailer: git-send-email 1.7.12.3 In-Reply-To: <510BF1C4.4050108@redhat.com> References: <510BF1C4.4050108@redhat.com> Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org When releasing a packet socket, the routine packet_set_ring() is reused to free rings instead of allocating them. But when calling it for the first time, it fills req->tp_block_nr with the value of rb->pg_vec_len which in the second invocation makes it bail out since req->tp_block_nr is greater zero but req->tp_block_size is zero. This patch solves the problem by passing a zeroed auto-variable to packet_set_ring() upon each invocation from packet_release(). As far as I can tell, this issue exists even since 69e3c75 (net: TX_RING and packet mmap), i.e. the original inclusion of TX ring support into af_packet, but applies only to sockets with both RX and TX ring allocated, which is probably why this was unnoticed all the time. Signed-off-by: Phil Sutter Cc: Johann Baudy Cc: Daniel Borkmann Acked-by: Daniel Borkmann --- Changes since v1: - less functions - more code duplication --- net/packet/af_packet.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index a91fd0b..07c9483 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -2364,13 +2364,15 @@ static int packet_release(struct socket *sock) packet_flush_mclist(sk); - memset(&req_u, 0, sizeof(req_u)); - - if (po->rx_ring.pg_vec) + if (po->rx_ring.pg_vec) { + memset(&req_u, 0, sizeof(req_u)); packet_set_ring(sk, &req_u, 1, 0); + } - if (po->tx_ring.pg_vec) + if (po->tx_ring.pg_vec) { + memset(&req_u, 0, sizeof(req_u)); packet_set_ring(sk, &req_u, 1, 1); + } fanout_release(sk);