shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-03-24 19:40:21 +09:00
Code Issues Packages Projects Releases Wiki Activity
Files
d73139a2a888cd8a0cc068232084ad5e9972aa8a
linux/net
History
Liu Shixin b8da7e7ae8 NFC: nci: fix memory leak in nci_rx_data_packet() 
[ Upstream commit 53270fb0fd ]

Syzbot reported a memory leak about skb:

unreferenced object 0xffff88810e144e00 (size 240):
  comm "syz-executor284", pid 3701, jiffies 4294952403 (age 12.620s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff83ab79a9>] __alloc_skb+0x1f9/0x270 net/core/skbuff.c:497
    [<ffffffff82a5cf64>] alloc_skb include/linux/skbuff.h:1267 [inline]
    [<ffffffff82a5cf64>] virtual_ncidev_write+0x24/0xe0 drivers/nfc/virtual_ncidev.c:116
    [<ffffffff815f6503>] do_loop_readv_writev fs/read_write.c:759 [inline]
    [<ffffffff815f6503>] do_loop_readv_writev fs/read_write.c:743 [inline]
    [<ffffffff815f6503>] do_iter_write+0x253/0x300 fs/read_write.c:863
    [<ffffffff815f66ed>] vfs_writev+0xdd/0x240 fs/read_write.c:934
    [<ffffffff815f68f6>] do_writev+0xa6/0x1c0 fs/read_write.c:977
    [<ffffffff848802d5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    [<ffffffff848802d5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
    [<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

In nci_rx_data_packet(), if we don't get a valid conn_info, we will return
directly but forget to release the skb.

Reported-by: syzbot+cdb9a427d1bc08815104@syzkaller.appspotmail.com
Fixes: 4aeee6871e ("NFC: nci: Add dynamic logical connections support")
Signed-off-by: Liu Shixin <liushixin2@huawei.com>
Link: https://lore.kernel.org/r/20221118082419.239475-1-liushixin2@huawei.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-06-13 14:13:45 +09:00
..
6lowpan
6lowpan: Off by one handling ->nexthdr
2023-05-15 16:44:57 +09:00
9p
9p/fd: fix issue of list_del corruption in p9_fd_cancel()
2023-06-13 14:13:45 +09:00
802
net/802/garp: fix memleak in garp_request_join()
2023-05-16 11:34:46 +09:00
8021q
vlan: fix memory leak in vlan_dev_set_egress_priority
2023-05-15 16:32:51 +09:00
appletalk
appletalk: Fix skb allocation size in loopback case
2023-05-16 10:49:55 +09:00
atm
net/atm: fix proc_mpc_write incorrect return value
2023-06-13 14:13:37 +09:00
ax25
ax25: Fix NULL pointer dereference in ax25_kill_by_device
2023-05-16 12:45:55 +09:00
batman-adv
batman-adv: Don't expect inter-netns unique iflink indices
2023-05-16 12:46:11 +09:00
bluetooth
Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm
2023-06-13 14:13:42 +09:00
bridge
netfilter: br_netfilter: Drop dst references before setting.
2023-06-13 14:13:27 +09:00
caif
net: caif: fix double disconnect client in chnl_net_open()
2023-06-13 14:13:43 +09:00
can
can: bcm: check the result of can_send() in bcm_can_tx()
2023-06-13 14:13:35 +09:00
ceph
libceph: clear con->out_msg on Policy::stateful_server faults
2023-05-16 09:45:38 +09:00
core
net: gso: fix panic on frag_list with mixed head alloc types
2023-06-13 14:13:41 +09:00
dcb
net: dcb: disable softirqs in dcbnl_flush_dev()
2023-05-16 12:44:53 +09:00
dccp
dccp: don't duplicate ccid when cloning dccp sock
2023-05-16 11:46:42 +09:00
decnet
net: decnet: Fix sleeping inside in af_decnet
2023-05-16 11:34:05 +09:00
dns_resolver
KEYS: DNS: fix parsing multiple options
2023-05-12 16:29:40 +09:00
dsa
net: dsa: tag_brcm: Fix skb->fwd_offload_mark location
2023-05-15 17:13:02 +09:00
ethernet
net: add annotations on hh->hh_len lockless accesses
2023-05-15 16:31:00 +09:00
hsr
hsr: use netdev_err() instead of WARN_ONCE()
2023-05-16 10:54:56 +09:00
ieee802154
net: ieee802154: fix error return code in dgram_bind()
2023-06-13 14:13:38 +09:00
ipv4
tcp: cdg: allow tcp_cdg_release() to be called multiple times
2023-06-13 14:13:44 +09:00
ipv6
xfrm: Fix ignored return value in xfrm6_init()
2023-06-13 14:13:45 +09:00
ipx
ipx: call ipxitf_put() in ioctl error path
2017-05-25 15:44:41 +02:00
irda
irda: Fix memory leak caused by repeated binds of irda socket
2023-05-12 17:27:16 +09:00
iucv
net/af_iucv: set correct sk_protocol for child sockets
2023-05-16 09:50:42 +09:00
kcm
kcm: avoid potential race in kcm_tx_work
2023-06-13 14:13:44 +09:00
key
af_key: Fix send_acquire race with pfkey_register
2023-06-13 14:13:45 +09:00
l2tp
l2tp: fix race in pppol2tp_release with session object destroy
2023-06-13 14:13:12 +09:00
l3mdev
net: ipv6: Remove l3mdev_get_saddr6
2016-09-10 23:12:53 -07:00
lapb
net: lapb: Copy the skb before sending a packet
2023-05-16 10:34:08 +09:00
llc
llc: only change llc->dev when bind() succeeds
2023-05-16 12:47:02 +09:00
mac80211
wifi: mac80211: Fix ack frame idr leak when mesh has no route
2023-06-13 14:13:45 +09:00
mac802154
mac802154: Fix LQI recording
2023-06-13 14:13:38 +09:00
mpls
net: avoid infinite loop in mpls_gso_segment when mpls_hlen == 0
2023-05-16 10:46:16 +09:00
ncsi
net/ncsi: Use real net-device for response handler
2023-05-16 10:24:55 +09:00
netfilter
ipvs: use explicitly signed chars
2023-06-13 14:13:39 +09:00
netlabel
cipso,calipso: resolve a number of problems with the DOI refcounts
2023-05-16 12:33:58 +09:00
netlink
netlink: do not reset transport header in netlink_recvmsg()
2023-06-13 14:12:48 +09:00
netrom
netrom: Decrease sock refcount when sock timers expire
2023-05-16 11:34:06 +09:00
nfc
NFC: nci: fix memory leak in nci_rx_data_packet()
2023-06-13 14:13:45 +09:00
openvswitch
openvswitch: switch from WARN to pr_warn
2023-06-13 14:13:39 +09:00
packet
net/packet: fix packet_sock xmit return value checking
2023-06-13 14:12:43 +09:00
phonet
phonet: refcount leak in pep_sock_accep
2023-05-16 12:30:20 +09:00
qrtr
net: qrtr: fix a kernel-infoleak in qrtr_recvmsg()
2023-05-16 10:49:33 +09:00
rds
net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks()
2023-06-13 14:13:33 +09:00
rfkill
rfkill: Fix incorrect check to avoid NULL pointer dereference
2023-05-15 16:32:30 +09:00
rose
rose: Fix NULL pointer dereference in rose_send_frame()
2023-06-13 14:13:40 +09:00
rxrpc
rxrpc: Don't try to resend the request if we're receiving the reply
2023-06-13 14:12:54 +09:00
sched
net: sched: Fix use after free in red_enqueue()
2023-06-13 14:13:39 +09:00
sctp
sctp: read sk->sk_bound_dev_if once in sctp_rcv()
2023-06-13 14:12:54 +09:00
strparser
strparser: Fix incorrect strp->need_bytes value.
2018-04-29 11:32:02 +02:00
sunrpc
SUNRPC: use _bh spinlocking on ->transport_lock
2023-06-13 14:13:27 +09:00
switchdev
switchdev: Execute bridge ndos only for bridge ports
2016-10-19 10:58:04 -04:00
tipc
tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header
2023-06-13 14:13:41 +09:00
unix
af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress
2023-05-16 12:33:30 +09:00
vmw_vsock
vsock: Fix memory leak in vsock_connect()
2023-06-13 14:13:23 +09:00
wimax
net:wimax: Fix doucble word "the the" in networking.xml
2015-08-09 22:43:52 -07:00
wireguard
ODROID: Remove some redefined variables.
2023-06-13 14:13:08 +09:00
wireless
wifi: cfg80211: debugfs: fix return type in ht40allow_map_read()
2023-06-13 14:13:26 +09:00
x25
net/x25: Fix skb leak in x25_lapb_receive_frame()
2023-06-13 14:13:43 +09:00
xfrm
xfrm: Update ipcomp_scratches with NULL when freed
2023-06-13 14:13:35 +09:00
compat.c
net: Return the correct errno code
2023-05-16 11:14:47 +09:00
Kconfig
net/wireguard: add WireGuard 1.0.20200712
2023-05-15 17:31:52 +09:00
Makefile
net: split out functions related to registering inflight socket files
2023-05-16 11:34:41 +09:00
socket.c
net: Fix a data-race around sysctl_somaxconn.
2023-06-13 14:13:24 +09:00
sysctl_net.c
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace
2016-10-06 09:52:23 -07:00