From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1759936AbcCDQPU (ORCPT ); Fri, 4 Mar 2016 11:15:20 -0500 Received: from wtarreau.pck.nerim.net ([62.212.114.60]:60581 "EHLO 1wt.eu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1758358AbcCDQCf (ORCPT ); Fri, 4 Mar 2016 11:02:35 -0500 Message-Id: <20160304153001.410771397@1wt.eu> User-Agent: quilt/0.63-1 Date: Fri, 04 Mar 2016 16:30:16 +0100 From: Willy Tarreau To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Dmitry Vyukov , Eric Dumazet , Rainer Weikusat , "David S. Miller" , Ben Hutchings , Willy Tarreau Subject: [PATCH 2.6.32 16/55] af_unix: fix struct pid memory leak MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-15 In-Reply-To: <148ee355b419e9976ca727513a1405c8@local> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 2.6.32-longterm review patch. If anyone has any objections, please let me know. ------------------ From: Eric Dumazet commit fa0dc04df259ba2df3ce1920e9690c7842f8fa4b upstream. Dmitry reported a struct pid leak detected by a syzkaller program. Bug happens in unix_stream_recvmsg() when we break the loop when a signal is pending, without properly releasing scm. Fixes: b3ca9b02b007 ("net: fix multithreaded signal handling in unix recv routines") Reported-by: Dmitry Vyukov Signed-off-by: Eric Dumazet Cc: Rainer Weikusat Signed-off-by: David S. Miller Cc: Ben Hutchings [wt: note, according to Rainer & Ben the bug was really introduced in 2.5.65, not by the commit mentionned in Fixes. 2.6.32 uses siocb->scm instead of scm] Signed-off-by: Willy Tarreau --- net/unix/af_unix.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c index 8e6a609..67f50be 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c @@ -2018,6 +2018,7 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock, if (signal_pending(current)) { err = sock_intr_errno(timeo); + scm_destroy(siocb->scm); goto out; } mutex_lock(&u->readlock); -- 1.7.12.2.21.g234cd45.dirty