aboutsummaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorTommi Rantala <tt.rantala@gmail.com>2012-11-27 04:01:46 +0000
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2013-01-11 09:03:35 -0800
commite620776f6cfe4e60acd2f2cec9210934cdb24b17 (patch)
treea3796758e76c196023adc5e2bdda31a9655923e3 /net
parentcefbc0583507deea5f6fd6232909761e0c3cc01a (diff)
downloadkernel_samsung_smdk4412-e620776f6cfe4e60acd2f2cec9210934cdb24b17.zip
kernel_samsung_smdk4412-e620776f6cfe4e60acd2f2cec9210934cdb24b17.tar.gz
kernel_samsung_smdk4412-e620776f6cfe4e60acd2f2cec9210934cdb24b17.tar.bz2
sctp: fix memory leak in sctp_datamsg_from_user() when copy from user space fails
[ Upstream commit be364c8c0f17a3dd42707b5a090b318028538eb9 ] Trinity (the syscall fuzzer) discovered a memory leak in SCTP, reproducible e.g. with the sendto() syscall by passing invalid user space pointer in the second argument: #include <string.h> #include <arpa/inet.h> #include <sys/socket.h> int main(void) { int fd; struct sockaddr_in sa; fd = socket(AF_INET, SOCK_STREAM, 132 /*IPPROTO_SCTP*/); if (fd < 0) return 1; memset(&sa, 0, sizeof(sa)); sa.sin_family = AF_INET; sa.sin_addr.s_addr = inet_addr("127.0.0.1"); sa.sin_port = htons(11111); sendto(fd, NULL, 1, 0, (struct sockaddr *)&sa, sizeof(sa)); return 0; } As far as I can tell, the leak has been around since ~2003. Signed-off-by: Tommi Rantala <tt.rantala@gmail.com> Acked-by: Vlad Yasevich <vyasevich@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net')
-rw-r--r--net/sctp/chunk.c7
1 files changed, 5 insertions, 2 deletions
diff --git a/net/sctp/chunk.c b/net/sctp/chunk.c
index 6c85564..9534bf9 100644
--- a/net/sctp/chunk.c
+++ b/net/sctp/chunk.c
@@ -284,7 +284,7 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc,
goto errout;
err = sctp_user_addto_chunk(chunk, offset, len, msgh->msg_iov);
if (err < 0)
- goto errout;
+ goto errout_chunk_free;
offset += len;
@@ -324,7 +324,7 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc,
__skb_pull(chunk->skb, (__u8 *)chunk->chunk_hdr
- (__u8 *)chunk->skb->data);
if (err < 0)
- goto errout;
+ goto errout_chunk_free;
sctp_datamsg_assign(msg, chunk);
list_add_tail(&chunk->frag_list, &msg->chunks);
@@ -332,6 +332,9 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc,
return msg;
+errout_chunk_free:
+ sctp_chunk_free(chunk);
+
errout:
list_for_each_safe(pos, temp, &msg->chunks) {
list_del_init(pos);