kernel memory leak fix for af_unix datagram getpeersec

kernel memory leak fix for af_unix datagram getpeersec

[Catherine Zhang]

Hi, Catalin and Michal,

Enclosed please find the patch against 2.6.18-rc1 that fixed the kernel 
memory leak problem.

Thanks for your help!
Catherine

--

From: cxzhang@watson.ibm.com
Fix the memory leak problem of the original unix datagram getpeersec patch. 

---

 include/net/scm.h      |    4 +++-
 net/ipv4/ip_sockglue.c |    1 +
 2 files changed, 4 insertions(+), 1 deletion(-)

diff -puN include/net/scm.h~af_unix-datagram-getpeersec-ml-fix include/net/scm.h
--- linux-2.6.18-rc1/include/net/scm.h~af_unix-datagram-getpeersec-ml-fix	2006-07-14 20:44:13.000000000 -0400
+++ linux-2.6.18-rc1-cxzhang/include/net/scm.h	2006-07-14 20:45:07.000000000 -0400
@@ -55,8 +55,10 @@ static __inline__ int scm_send(struct so
 #ifdef CONFIG_SECURITY_NETWORK
 static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct scm_cookie *scm)
 {
-	if (test_bit(SOCK_PASSSEC, &sock->flags) && scm->secdata != NULL)
+	if (test_bit(SOCK_PASSSEC, &sock->flags) && scm->secdata != NULL) {
 		put_cmsg(msg, SOL_SOCKET, SCM_SECURITY, scm->seclen, scm->secdata);
+		kfree(scm->secdata);
+	}
 }
 #else
 static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct scm_cookie *scm)
diff -puN net/ipv4/ip_sockglue.c~af_unix-datagram-getpeersec-ml-fix net/ipv4/ip_sockglue.c
--- linux-2.6.18-rc1/net/ipv4/ip_sockglue.c~af_unix-datagram-getpeersec-ml-fix	2006-07-15 19:03:07.000000000 -0400
+++ linux-2.6.18-rc1-cxzhang/net/ipv4/ip_sockglue.c	2006-07-15 19:03:27.000000000 -0400
@@ -120,6 +120,7 @@ static void ip_cmsg_recv_security(struct
 		return;
 
 	put_cmsg(msg, SOL_IP, SCM_SECURITY, seclen, secdata);
+	kfree(secdata);
 }
 
 
_

Re: kernel memory leak fix for af_unix datagram getpeersec

[James Morris]

On Sun, 16 Jul 2006, Catherine Zhang wrote:

> 
> Hi, Catalin and Michal,
> 
> Enclosed please find the patch against 2.6.18-rc1 that fixed the kernel 
> memory leak problem.

The core kernel code doesn't know anything about secdata, as it is up to 
the LSM to determine what it is (in the case of SELinux, a kmalloc'd 
buffer).

So, you need a cleanup hook which allows the LSM to free the secdata if 
required.


- James
-- 
James Morris
<jmorris@namei.org>

Re: kernel memory leak fix for af_unix datagram getpeersec

[Michal Piotrowski]

Hi Catherine,

On 16/07/06, Catherine Zhang <cxzhang@watson.ibm.com> wrote:
>
> Hi, Catalin and Michal,
>
> Enclosed please find the patch against 2.6.18-rc1 that fixed the kernel
> memory leak problem.

I still get a lot of memory leak reports.

[michal@ltg01-fedora ~]$ cat /tmp/ml1.txt | grep -c
selinux_socket_getpeersec_dgram
802
[michal@ltg01-fedora ~]$ cat /tmp/ml2.txt | grep -c
selinux_socket_getpeersec_dgram
816

>
> Thanks for your help!
> Catherine

Regards,
Michal

-- 
Michal K. K. Piotrowski
LTG - Linux Testers Group
(http://www.stardust.webpages.pl/ltg/wiki/)