diff options
author | Phil Sutter <phil.sutter@viprinet.com> | 2013-02-01 07:21:41 +0000 |
---|---|---|
committer | Ben Hutchings <ben@decadent.org.uk> | 2013-02-20 03:15:35 +0000 |
commit | bf4f81cd04a2db72cea6f15b41df71b3f6e8dfd6 (patch) | |
tree | a33e9328632afd9691cc5340c77b42e83108e08c /net/packet/af_packet.c | |
parent | 0d6a77079c475033cb622c07c5a880b392ef664e (diff) | |
download | kernel_samsung_smdk4412-bf4f81cd04a2db72cea6f15b41df71b3f6e8dfd6.zip kernel_samsung_smdk4412-bf4f81cd04a2db72cea6f15b41df71b3f6e8dfd6.tar.gz kernel_samsung_smdk4412-bf4f81cd04a2db72cea6f15b41df71b3f6e8dfd6.tar.bz2 |
packet: fix leakage of tx_ring memory
[ Upstream commit 9665d5d62487e8e7b1f546c00e11107155384b9a ]
When releasing a packet socket, the routine packet_set_ring() is reused
to free rings instead of allocating them. But when calling it for the
first time, it fills req->tp_block_nr with the value of rb->pg_vec_len
which in the second invocation makes it bail out since req->tp_block_nr
is greater zero but req->tp_block_size is zero.
This patch solves the problem by passing a zeroed auto-variable to
packet_set_ring() upon each invocation from packet_release().
As far as I can tell, this issue exists even since 69e3c75 (net: TX_RING
and packet mmap), i.e. the original inclusion of TX ring support into
af_packet, but applies only to sockets with both RX and TX ring
allocated, which is probably why this was unnoticed all the time.
Signed-off-by: Phil Sutter <phil.sutter@viprinet.com>
Cc: Johann Baudy <johann.baudy@gnu-log.net>
Cc: Daniel Borkmann <dborkman@redhat.com>
Acked-by: Daniel Borkmann <dborkman@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'net/packet/af_packet.c')
-rw-r--r-- | net/packet/af_packet.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index 85afc13..835fcea 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -2422,13 +2422,15 @@ static int packet_release(struct socket *sock) packet_flush_mclist(sk); - memset(&req_u, 0, sizeof(req_u)); - - if (po->rx_ring.pg_vec) + if (po->rx_ring.pg_vec) { + memset(&req_u, 0, sizeof(req_u)); packet_set_ring(sk, &req_u, 1, 0); + } - if (po->tx_ring.pg_vec) + if (po->tx_ring.pg_vec) { + memset(&req_u, 0, sizeof(req_u)); packet_set_ring(sk, &req_u, 1, 1); + } fanout_release(sk); |