iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/include/net
History
Zhengchao Shao 176ee6c673 sctp: fix memory leak in sctp_stream_outq_migrate() 
[ Upstream commit 9ed7bfc79542119ac0a9e1ce8a2a5285e43433e9 ]

When sctp_stream_outq_migrate() is called to release stream out resources,
the memory pointed to by prio_head in stream out is not released.

The memory leak information is as follows:
 unreferenced object 0xffff88801fe79f80 (size 64):
   comm "sctp_repo", pid 7957, jiffies 4294951704 (age 36.480s)
   hex dump (first 32 bytes):
     80 9f e7 1f 80 88 ff ff 80 9f e7 1f 80 88 ff ff  ................
     90 9f e7 1f 80 88 ff ff 90 9f e7 1f 80 88 ff ff  ................
   backtrace:
     [<ffffffff81b215c6>] kmalloc_trace+0x26/0x60
     [<ffffffff88ae517c>] sctp_sched_prio_set+0x4cc/0x770
     [<ffffffff88ad64f2>] sctp_stream_init_ext+0xd2/0x1b0
     [<ffffffff88aa2604>] sctp_sendmsg_to_asoc+0x1614/0x1a30
     [<ffffffff88ab7ff1>] sctp_sendmsg+0xda1/0x1ef0
     [<ffffffff87f765ed>] inet_sendmsg+0x9d/0xe0
     [<ffffffff8754b5b3>] sock_sendmsg+0xd3/0x120
     [<ffffffff8755446a>] __sys_sendto+0x23a/0x340
     [<ffffffff87554651>] __x64_sys_sendto+0xe1/0x1b0
     [<ffffffff89978b49>] do_syscall_64+0x39/0xb0
     [<ffffffff89a0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

Link: https://syzkaller.appspot.com/bug?exrid=29c402e56c4760763cc0
Fixes: 637784ade221 ("sctp: introduce priority based stream scheduler")
Reported-by: syzbot+29c402e56c4760763cc0@syzkaller.appspotmail.com
Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
Reviewed-by: Xin Long <lucien.xin@gmail.com>
Link: https://lore.kernel.org/r/20221126031720.378562-1-shaozhengchao@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-12-08 11:23:57 +01:00
..
9p
net: 9p: drop duplicate word in comment
2020-07-15 20:34:11 -07:00
bluetooth
Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put
2022-08-03 12:00:43 +02:00
caif
net: caif: add proper error handling
2021-06-10 13:39:24 +02:00
iucv
net/af_iucv: clean up function prototypes
2020-05-19 12:50:14 -07:00
netfilter
netfilter: nf_tables: disallow jump to implicit chain from set element
2022-08-31 17:15:18 +02:00
netns
xfrm: rework default policy structure
2022-05-25 09:17:58 +02:00
nfc
NFC: add NCI_UNREG flag to eliminate the race
2021-11-26 10:39:18 +01:00
phonet
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 336
2019-06-05 17:37:07 +02:00
sctp
sctp: fix memory leak in sctp_stream_outq_migrate()
2022-12-08 11:23:57 +01:00
tc_act
net/sched: act_pedit: really ensure the skb is writable
2022-05-18 10:23:44 +02:00
6lowpan.h
6lowpan: Replace zero-length array with flexible-array member
2020-02-28 14:51:30 +01:00
act_api.h
net: sched: fix err handler in tcf_action_init()
2021-04-14 08:42:05 +02:00
addrconf.h
ipv6/addrconf: fix a null-ptr-deref bug for ip6_ptr
2022-08-03 12:00:46 +02:00
af_ieee802154.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174
2019-05-30 11:26:41 -07:00
af_rxrpc.h
rxrpc: Make rxrpc_kernel_get_srtt() indicate validity
2020-08-20 18:21:28 +01:00
af_unix.h
unix: uses an atomic type for scm files accounting
2020-02-28 12:12:53 -08:00
af_vsock.h
vsock: each transport cycles only on its own sockets
2022-03-23 09:13:27 +01:00
ah.h
…
arp.h
ipv4: Invalidate neighbour for broadcast address upon address addition
2022-04-13 21:00:57 +02:00
atmclip.h
…
ax25.h
ax25: fix reference count leaks of ax25_dev
2022-04-20 09:23:31 +02:00
ax88796.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
bareudp.h
bareudp: Reverted support to enable & disable rx metadata collection
2020-07-21 18:30:47 -07:00
bond_3ad.h
net: bonding: Share lacpdu_mcast_addr definition
2022-09-28 11:10:31 +02:00
bond_alb.h
bonding: make tx_rebalance_counter an atomic
2021-12-14 11:32:36 +01:00
bond_options.h
bonding: add an option to specify a delay between peer notifications
2019-07-04 12:30:48 -07:00
bonding.h
net: bonding: Share lacpdu_mcast_addr definition
2022-09-28 11:10:31 +02:00
bpf_sk_storage.h
bpf: Change bpf_sk_storage_*() to accept ARG_PTR_TO_BTF_ID_SOCK_COMMON
2020-09-25 13:58:01 -07:00
busy_poll.h
net: Fix a data-race around sysctl_net_busy_poll.
2022-08-31 17:15:20 +02:00
calipso.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13
2019-05-21 11:28:45 +02:00
cfg80211-wext.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
cfg80211.h
cfg80211: fix management registrations locking
2021-11-02 19:48:20 +01:00
cfg802154.h
cfg802154: Replace zero-length array with flexible-array member
2020-02-29 14:39:08 +01:00
checksum.h
net: Force inlining of checksum functions in net/checksum.h
2022-03-02 11:42:50 +01:00
cipso_ipv4.h
cipso: Remove unused inline functions
2020-07-15 07:45:24 -07:00
cls_cgroup.h
bpf: Allow to retrieve cgroup v1 classid from v2 hooks
2020-03-27 19:40:38 -07:00
codel_impl.h
…
codel_qdisc.h
…
codel.h
…
compat.h
net: simplify cBPF setsockopt compat handling
2020-07-19 18:16:40 -07:00
datalink.h
…
dcbevent.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 201
2019-05-30 11:29:52 -07:00
dcbnl.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 201
2019-05-30 11:29:52 -07:00
devlink.h
devlink: Add enable_remote_dev_reset generic parameter
2020-10-09 12:06:53 -07:00
dn_dev.h
…
dn_fib.h
net: dn_fib: Replace zero-length array with flexible-array member
2020-02-29 21:52:20 -08:00
dn_neigh.h
…
dn_nsp.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 24
2019-05-21 11:52:39 +02:00
dn_route.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 24
2019-05-21 11:52:39 +02:00
dn.h
…
dsa.h
net: dsa: propagate switchdev vlan_filtering prepare phase to drivers
2020-10-05 05:56:48 -07:00
dsfield.h
ipv6: Annotate bitwise IPv6 dsfield pointer cast
2019-12-16 16:09:44 -08:00
dst_cache.h
wireguard: device: reset peer src endpoint when netns exits
2021-12-08 09:03:22 +01:00
dst_metadata.h
net: fix a memleak when uncloning an skb dst and its metadata
2022-02-16 12:54:26 +01:00
dst_ops.h
net/dst: use a smaller percpu_counter batch for dst entries accounting
2020-05-08 21:33:33 -07:00
dst.h
net: Consolidate common blackhole dst ops
2021-03-30 14:32:05 +02:00
erspan.h
erspan: Add type I version 0 support.
2020-05-05 13:23:29 -07:00
esp.h
esp: limit skb_page_frag_refill use to a single page
2022-04-27 13:53:48 +02:00
espintcp.h
xfrm: espintcp: save and call old ->sk_destruct
2020-04-20 07:34:16 +02:00
ethoc.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
failover.h
…
fib_notifier.h
ipv6: Remove old route notifications and convert listeners
2019-12-24 22:37:30 -08:00
fib_rules.h
ipv6: fix memory leak in fib6_rule_suppress
2021-12-08 09:03:21 +01:00
firewire.h
…
flow_dissector.h
net/sched: flower: fix parsing of ethertype following VLAN header
2022-04-20 09:23:11 +02:00
flow_offload.h
netfilter: nf_tables: bail out early if hardware offload is not supported
2022-06-14 18:32:40 +02:00
flow.h
lsm,selinux: pass flowi_common instead of flowi to the LSM hooks
2022-06-09 10:21:09 +02:00
fou.h
…
fq_impl.h
net/fq_impl: use skb_get_hash instead of skb_get_hash_perturb
2020-07-31 09:24:24 +02:00
fq.h
net/fq_impl: use skb_get_hash instead of skb_get_hash_perturb
2020-07-31 09:24:24 +02:00
garp.h
treewide: Use sizeof_field() macro
2019-12-09 10:36:44 -08:00
gen_stats.h
net_sched: extend packet counter to 64bit
2019-11-05 18:20:55 -08:00
genetlink.h
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2020-10-05 18:40:01 -07:00
geneve.h
net: Move the definition of the default Geneve udp port to public header file
2019-03-22 12:09:31 -07:00
gre.h
…
gro_cells.h
…
gtp.h
…
gue.h
GUE: Fix a typo
2020-06-22 21:12:44 -07:00
hwbm.h
net: hwbm: if CONFIG_NET_HWBM unset, make stub functions static
2019-10-25 16:24:32 -07:00
icmp.h
net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending
2021-03-04 11:38:46 +01:00
ieee80211_radiotap.h
mac80211: add radiotap flag to prevent sequence number overwrite
2020-07-31 09:27:00 +02:00
ieee802154_netdev.h
net: ieee802154: return -EINVAL for unknown addr type
2022-10-26 13:25:55 +02:00
if_inet6.h
ipv6: fix locking issues with loops over idev->addr_list
2022-06-09 10:20:50 +02:00
ife.h
net: ife: drop include of module.h from net/ife.h
2019-04-22 21:50:53 -07:00
ila.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
inet6_connection_sock.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
inet6_hashtables.h
net: allow unbound socket for packets in VRF when tcp_l3mdev_accept set
2022-08-21 15:15:51 +02:00
inet_common.h
bpf: Allow any port in bpf_bind helper
2020-05-09 00:48:20 +02:00
inet_connection_sock.h
Revert "tcp: change pingpong threshold to 3"
2022-08-03 12:00:45 +02:00
inet_ecn.h
inet_ecn: Fix endianness of checksum update when setting ECT(1)
2020-12-01 17:16:54 -08:00
inet_frag.h
inet: frags: annotate races around fqdir->dead and fqdir->high_thresh
2022-01-27 10:54:33 +01:00
inet_hashtables.h
net: allow unbound socket for packets in VRF when tcp_l3mdev_accept set
2022-08-21 15:15:51 +02:00
inet_sock.h
net: allow unbound socket for packets in VRF when tcp_l3mdev_accept set
2022-08-21 15:15:51 +02:00
inet_timewait_sock.h
tcp: honor SO_PRIORITY in TIME_WAIT state
2019-09-27 12:05:02 +02:00
inetpeer.h
net: ipv4: use a dedicated counter for icmp_v4 redirect packets
2019-02-08 21:50:15 -08:00
ip6_checksum.h
tcp: remove indirect calls for icsk->icsk_af_ops->send_check
2020-06-20 17:47:53 -07:00
ip6_fib.h
ipv6: annotate accesses to fn->fn_sernum
2022-02-01 17:25:44 +01:00
ip6_route.h
net: ipv6: fix returned variable type in ip6_skb_dst_mtu
2021-08-12 13:22:07 +02:00
ip6_tunnel.h
ip_gre, ip6_gre: Fix race condition on o_seqno in collect_md mode
2022-05-09 09:05:04 +02:00
ip_fib.h
ipv4: convert fib_num_tclassid_users to atomic_t
2021-12-08 09:03:26 +01:00
ip_tunnels.h
ip_gre, ip6_gre: Fix race condition on o_seqno in collect_md mode
2022-05-09 09:05:04 +02:00
ip_vs.h
ipvs: remove dependency on ip6_tables
2020-08-31 23:06:51 +02:00
ip.h
net: use struct_group to copy ip/ipv6 header addresses
2022-11-25 17:45:55 +01:00
ipcomp.h
…
ipconfig.h
…
ipv6_frag.h
inet: frags: annotate races around fqdir->dead and fqdir->high_thresh
2022-01-27 10:54:33 +01:00
ipv6_stubs.h
net: ipv6: add fib6_nh_release_dsts stub
2021-12-01 09:19:05 +01:00
ipv6.h
net: use struct_group to copy ip/ipv6 header addresses
2022-11-25 17:45:55 +01:00
ipx.h
bonding/alb: properly access headers in bond_alb_xmit()
2020-02-05 14:28:09 +01:00
iw_handler.h
…
kcm.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
l3mdev.h
l3mdev: add infrastructure for table to VRF mapping
2020-06-20 17:22:22 -07:00
lag.h
…
lapb.h
…
lib80211.h
…
llc_c_ac.h
…
llc_c_ev.h
…
llc_c_st.h
…
llc_conn.h
llc: fix sk_buff leak in llc_conn_service()
2019-10-08 13:23:05 -07:00
llc_if.h
…
llc_pdu.h
net: llc: fix skb_over_panic
2021-08-04 12:46:43 +02:00
llc_s_ac.h
…
llc_s_ev.h
…
llc_s_st.h
…
llc_sap.h
…
llc.h
llc: fix out-of-bound array index in llc_sk_dev_hash()
2021-11-18 14:04:27 +01:00
lwtunnel.h
net: add net available in build_state
2020-03-29 22:30:57 -07:00
mac80211.h
mac80211: Fix NULL ptr deref for injected rate info
2021-06-23 14:42:52 +02:00
mac802154.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174
2019-05-30 11:26:41 -07:00
macsec.h
net: macsec: fix the length used to copy the key for offloading
2021-07-14 16:56:28 +02:00
mip6.h
net: mip6: Replace zero-length array with flexible-array member
2020-03-02 11:16:27 -08:00
mld.h
net: ipv6: mld: Replace zero-length array with flexible-array member
2020-02-29 21:52:20 -08:00
mpls_iptunnel.h
net: mpls: Replace zero-length array with flexible-array member
2020-02-28 12:08:37 -08:00
mpls.h
net: Make mpls_entry_encode() available for generic users
2020-05-29 21:20:20 -07:00
mptcp.h
net: tcp: drop unused function argument from mptcp_incoming_options
2020-09-24 20:17:01 -07:00
mrp.h
treewide: Use sizeof_field() macro
2019-12-09 10:36:44 -08:00
ncsi.h
…
ndisc.h
ipv6: ndisc: adjust ndisc_ifinfo_sysctl_change prototype
2020-08-24 06:40:07 -07:00
neighbour.h
net, neigh: Enable state migration between NUD_PERMANENT and NTF_USE
2021-11-18 14:04:29 +01:00
net_failover.h
…
net_namespace.h
net: make get_net_ns return error if NET_NS is disabled
2021-06-23 14:42:44 +02:00
net_ratelimit.h
…
netevent.h
…
netlabel.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13
2019-05-21 11:28:45 +02:00
netlink.h
netlink: export policy in extended ACK
2020-10-09 20:22:32 -07:00
netprio_cgroup.h
netprio: use css ID instead of cgroup ID
2019-11-12 08:18:03 -08:00
netrom.h
net: netrom: Fix error cleanup path of nr_proto_init
2019-04-11 13:59:49 -07:00
nexthop.h
net: ipv4: Fix rtnexthop len when RTA_FLOW is present
2021-10-06 15:55:53 +02:00
nl802154.h
net: ieee802154: handle iftypes as u32
2021-12-01 09:19:03 +01:00
nsh.h
…
p8022.h
…
page_pool.h
mm: fix struct page layout on 32-bit systems
2021-05-19 10:13:17 +02:00
pie.h
pie: realign comment
2020-03-04 13:25:55 -08:00
ping.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
pkt_cls.h
net: zero-initialize tc skb extension on allocation
2021-06-03 09:00:51 +02:00
pkt_sched.h
net: prevent user from passing illegal stab size
2021-10-17 10:43:33 +02:00
pptp.h
…
protocol.h
tcp/udp: Make early_demux back namespacified.
2022-11-10 18:14:26 +01:00
psample.h
psample: Add a fwd declaration for skbuff
2021-08-18 08:59:11 +02:00
psnap.h
…
raw.h
raw: Fix a data-race around sysctl_raw_l3mdev_accept.
2022-07-21 21:20:10 +02:00
rawv6.h
…
red.h
sch_red: fix off-by-one checks in red_check_params()
2021-04-14 08:42:07 +02:00
regulatory.h
net/wireless: regulatory.h: drop duplicate word in comment
2020-07-31 09:24:23 +02:00
request_sock.h
tcp: bpf: Optionally store mac header in TCP_SAVE_SYN
2020-08-24 14:35:00 -07:00
rose.h
…
route.h
lsm,selinux: pass flowi_common instead of flowi to the LSM hooks
2022-06-09 10:21:09 +02:00
rpl.h
net: ipv6: Use struct_size() helper and kcalloc()
2020-06-23 20:27:09 -07:00
rsi_91x.h
…
rtnetlink.h
can: dev: Move device back to init netns on owning netns delete
2021-03-30 14:32:08 +02:00
rtnh.h
net: Rename net/nexthop.h net/rtnh.h
2019-04-22 21:47:25 -07:00
sch_generic.h
net: sched: delete duplicate cleanup of backlog and qlen
2022-10-30 09:41:17 +01:00
scm.h
fs: Move __scm_install_fd() to __receive_fd()
2020-07-13 11:03:44 -07:00
secure_seq.h
secure_seq: use the 64 bits of the siphash for port offset calculation
2022-05-30 09:33:23 +02:00
seg6_hmac.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
seg6_local.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
seg6.h
seg6: fix seg6_validate_srh() to avoid slab-out-of-bounds
2020-06-04 15:39:32 -07:00
slhc_vj.h
…
smc.h
net/smc: introduce CHID callback for ISM devices
2020-09-28 15:19:03 -07:00
snmp.h
net/tls: add skeleton of MIB statistics
2019-10-05 16:29:00 -07:00
sock_reuseport.h
udp: Update reuse->has_conns under reuseport_lock.
2022-10-30 09:41:19 +01:00
sock.h
inet: fully convert sk->sk_rx_dst to RCU rules
2022-10-26 13:25:56 +02:00
Space.h
…
stp.h
…
strparser.h
bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding
2021-11-18 14:04:27 +01:00
switchdev.h
bridge: switchdev: Notify about VLAN protocol changes
2022-12-02 17:39:57 +01:00
tcp_states.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
tcp.h
tcp/udp: Make early_demux back namespacified.
2022-11-10 18:14:26 +01:00
timewait_sock.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
tipc.h
…
tls_toe.h
net/tls: rename tls_hw_* functions tls_toe_*
2019-10-04 14:07:07 -07:00
tls.h
net/tls: Check for errors in tls_device_init
2022-07-21 21:20:13 +02:00
transp_v6.h
tcp: move ipv4_specific to tcp include file
2020-06-23 20:10:15 -07:00
tso.h
net: tso: cache transport header length
2020-06-18 20:46:23 -07:00
tun_proto.h
…
udp_tunnel.h
udp: call udp_encap_enable for v6 sockets when enabling encap
2022-04-08 14:39:54 +02:00
udp.h
tcp/udp: Make early_demux back namespacified.
2022-11-10 18:14:26 +01:00
udplite.h
…
vsock_addr.h
vsock: remove include/linux/vm_sockets.h file
2019-11-14 18:12:17 -08:00
vxlan.h
net: sched: only keep the available bits when setting vxlan md->gbp
2020-09-14 16:49:39 -07:00
wext.h
…
wimax.h
net: wimax: fix duplicate words in comments
2020-07-15 20:34:02 -07:00
x25.h
net/x25: add new state X25_STATE_5
2019-12-09 10:28:43 -08:00
x25device.h
…
xdp_priv.h
page_pool: do not release pool until inflight == 0.
2019-11-16 12:39:10 -08:00
xdp_sock_drv.h
xsk: i40e: ice: ixgbe: mlx5: Test for dma_need_sync earlier for better performance
2020-08-31 21:15:04 +02:00
xdp_sock.h
xsk: Fix race in SKB mode transmit with shared cq
2021-01-17 14:17:05 +01:00
xdp.h
xdp: Remove the xdp_attachment_flags_ok() callback
2020-12-09 16:27:42 +01:00
xfrm.h
xfrm: fix "disable_policy" flag use when arriving from different devices
2022-05-25 09:17:58 +02:00
xsk_buff_pool.h
xsk: Inherit need_wakeup flag for shared sockets
2022-10-15 07:55:51 +02:00