[PATCH] net: xfrm: fix memory leak in xfrm_user_rcv_msg

Steffen Klassert steffen.klassert at secunet.com
Wed Jun 30 06:51:07 UTC 2021


On Fri, Jun 25, 2021 at 01:23:54PM +0300, Pavel Skripkin wrote:
> Syzbot reported memory leak in xfrm_user_rcv_msg(). The
> problem was is non-freed skb's frag_list.
> 
> In skb_release_all() skb_release_data() will be called only
> in case of skb->head != NULL, but netlink_skb_destructor()
> sets head to NULL. So, allocated frag_list skb should be
> freed manualy, since consume_skb() won't take care of it
> 
> Fixes: 5106f4a8acff ("xfrm/compat: Add 32=>64-bit messages translator")
> Reported-and-tested-by: syzbot+fb347cf82c73a90efcca at syzkaller.appspotmail.com
> Signed-off-by: Pavel Skripkin <paskripkin at gmail.com>

Applied, thanks a lot!


More information about the Linux-kernel-mentees mailing list