* [PATCH] net/x25: Fix x25_neigh refcnt leak when reveiving frame
@ 2020-04-23 5:13 Xiyu Yang
2020-04-23 7:14 ` Yuehaibing
2020-04-23 22:49 ` David Miller
0 siblings, 2 replies; 3+ messages in thread
From: Xiyu Yang @ 2020-04-23 5:13 UTC (permalink / raw)
To: Andrew Hendry, David S. Miller, Jakub Kicinski,
Greg Kroah-Hartman, Eric Dumazet, Allison Randal, Xiyu Yang,
Thomas Gleixner, linux-x25, netdev, linux-kernel
Cc: yuanxzhang, kjlu, Xin Tan
x25_lapb_receive_frame() invokes x25_get_neigh(), which returns a
reference of the specified x25_neigh object to "nb" with increased
refcnt.
When x25_lapb_receive_frame() returns, local variable "nb" becomes
invalid, so the refcount should be decreased to keep refcount balanced.
The reference counting issue happens in one path of
x25_lapb_receive_frame(). When pskb_may_pull() returns false, the
function forgets to decrease the refcnt increased by x25_get_neigh(),
causing a refcnt leak.
Fix this issue by calling x25_neigh_put() when pskb_may_pull() returns
false.
Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
---
net/x25/x25_dev.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/x25/x25_dev.c b/net/x25/x25_dev.c
index 00e782335cb0..25bf72ee6cad 100644
--- a/net/x25/x25_dev.c
+++ b/net/x25/x25_dev.c
@@ -115,8 +115,10 @@ int x25_lapb_receive_frame(struct sk_buff *skb, struct net_device *dev,
goto drop;
}
- if (!pskb_may_pull(skb, 1))
+ if (!pskb_may_pull(skb, 1)) {
+ x25_neigh_put(nb);
return 0;
+ }
switch (skb->data[0]) {
--
2.7.4
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] net/x25: Fix x25_neigh refcnt leak when reveiving frame
2020-04-23 5:13 [PATCH] net/x25: Fix x25_neigh refcnt leak when reveiving frame Xiyu Yang
@ 2020-04-23 7:14 ` Yuehaibing
2020-04-23 22:49 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: Yuehaibing @ 2020-04-23 7:14 UTC (permalink / raw)
To: Xiyu Yang, Andrew Hendry, David S. Miller, Jakub Kicinski,
Greg Kroah-Hartman, Eric Dumazet, Allison Randal,
Thomas Gleixner, linux-x25, netdev, linux-kernel
Cc: yuanxzhang, kjlu, Xin Tan
On 2020/4/23 13:13, Xiyu Yang wrote:
> x25_lapb_receive_frame() invokes x25_get_neigh(), which returns a
> reference of the specified x25_neigh object to "nb" with increased
> refcnt.
>
> When x25_lapb_receive_frame() returns, local variable "nb" becomes
> invalid, so the refcount should be decreased to keep refcount balanced.
>
> The reference counting issue happens in one path of
> x25_lapb_receive_frame(). When pskb_may_pull() returns false, the
> function forgets to decrease the refcnt increased by x25_get_neigh(),
> causing a refcnt leak.
>
> Fix this issue by calling x25_neigh_put() when pskb_may_pull() returns
> false.
>
Fixes: cb101ed2c3c7 ("x25: Handle undersized/fragmented skbs")
> Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
> Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
> ---
> net/x25/x25_dev.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/net/x25/x25_dev.c b/net/x25/x25_dev.c
> index 00e782335cb0..25bf72ee6cad 100644
> --- a/net/x25/x25_dev.c
> +++ b/net/x25/x25_dev.c
> @@ -115,8 +115,10 @@ int x25_lapb_receive_frame(struct sk_buff *skb, struct net_device *dev,
> goto drop;
> }
>
> - if (!pskb_may_pull(skb, 1))
> + if (!pskb_may_pull(skb, 1)) {
> + x25_neigh_put(nb);
> return 0;
> + }
>
> switch (skb->data[0]) {
>
>
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] net/x25: Fix x25_neigh refcnt leak when reveiving frame
2020-04-23 5:13 [PATCH] net/x25: Fix x25_neigh refcnt leak when reveiving frame Xiyu Yang
2020-04-23 7:14 ` Yuehaibing
@ 2020-04-23 22:49 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: David Miller @ 2020-04-23 22:49 UTC (permalink / raw)
To: xiyuyang19
Cc: andrew.hendry, kuba, gregkh, edumazet, allison, tglx, linux-x25,
netdev, linux-kernel, yuanxzhang, kjlu, tanxin.ctf
From: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Date: Thu, 23 Apr 2020 13:13:03 +0800
> x25_lapb_receive_frame() invokes x25_get_neigh(), which returns a
> reference of the specified x25_neigh object to "nb" with increased
> refcnt.
>
> When x25_lapb_receive_frame() returns, local variable "nb" becomes
> invalid, so the refcount should be decreased to keep refcount balanced.
>
> The reference counting issue happens in one path of
> x25_lapb_receive_frame(). When pskb_may_pull() returns false, the
> function forgets to decrease the refcnt increased by x25_get_neigh(),
> causing a refcnt leak.
>
> Fix this issue by calling x25_neigh_put() when pskb_may_pull() returns
> false.
>
> Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
> Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
Applied and queued up for -stable, thanks.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-04-23 22:49 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-04-23 5:13 [PATCH] net/x25: Fix x25_neigh refcnt leak when reveiving frame Xiyu Yang
2020-04-23 7:14 ` Yuehaibing
2020-04-23 22:49 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®