| Message ID | 20190723034122.23166-1-xiyou.wangcong@gmail.com |
|---|---|
| State | Accepted |
| Delegated to: | David Miller |
| Headers | show |
| Series | [net] netrom: hold sock when setting skb->destructor | expand |
From: Cong Wang <xiyou.wangcong@gmail.com> Date: Mon, 22 Jul 2019 20:41:22 -0700 > sock_efree() releases the sock refcnt, if we don't hold this refcnt > when setting skb->destructor to it, the refcnt would not be balanced. > This leads to several bug reports from syzbot. > > I have checked other users of sock_efree(), all of them hold the > sock refcnt. > > Fixes: c8c8218ec5af ("netrom: fix a memory leak in nr_rx_frame()") > Reported-and-tested-by: <syzbot+622bdabb128acc33427d@syzkaller.appspotmail.com> > Reported-and-tested-by: <syzbot+6eaef7158b19e3fec3a0@syzkaller.appspotmail.com> > Reported-and-tested-by: <syzbot+9399c158fcc09b21d0d2@syzkaller.appspotmail.com> > Reported-and-tested-by: <syzbot+a34e5f3d0300163f0c87@syzkaller.appspotmail.com> > Cc: Ralf Baechle <ralf@linux-mips.org> > Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Applied and queued up for -stable.
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c index 96740d389377..c4f54ad2b98a 100644 --- a/net/netrom/af_netrom.c +++ b/net/netrom/af_netrom.c @@ -967,6 +967,7 @@ int nr_rx_frame(struct sk_buff *skb, struct net_device *dev) window = skb->data[20]; + sock_hold(make); skb->sk = make; skb->destructor = sock_efree; make->sk_state = TCP_ESTABLISHED;
sock_efree() releases the sock refcnt, if we don't hold this refcnt when setting skb->destructor to it, the refcnt would not be balanced. This leads to several bug reports from syzbot. I have checked other users of sock_efree(), all of them hold the sock refcnt. Fixes: c8c8218ec5af ("netrom: fix a memory leak in nr_rx_frame()") Reported-and-tested-by: <syzbot+622bdabb128acc33427d@syzkaller.appspotmail.com> Reported-and-tested-by: <syzbot+6eaef7158b19e3fec3a0@syzkaller.appspotmail.com> Reported-and-tested-by: <syzbot+9399c158fcc09b21d0d2@syzkaller.appspotmail.com> Reported-and-tested-by: <syzbot+a34e5f3d0300163f0c87@syzkaller.appspotmail.com> Cc: Ralf Baechle <ralf@linux-mips.org> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> --- net/netrom/af_netrom.c | 1 + 1 file changed, 1 insertion(+)