From patchwork Fri Nov 18 08:24:19 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Liu Shixin X-Patchwork-Id: 22163 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:f944:0:0:0:0:0 with SMTP id q4csp47689wrr; Thu, 17 Nov 2022 23:38:04 -0800 (PST) X-Google-Smtp-Source: AA0mqf7nRBUk6FO3i08RIKuURsoLAhgdhrTeorn3AAobpATFc2f3V6wh7BqxEiitlP49OAjr6an8 X-Received: by 2002:a17:906:c1d2:b0:7ad:9028:4b16 with SMTP id bw18-20020a170906c1d200b007ad90284b16mr4986017ejb.604.1668757084571; Thu, 17 Nov 2022 23:38:04 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1668757084; cv=none; d=google.com; s=arc-20160816; b=QxgZN4DyPlAdDMkGGbHuGmtst01IP1Eh+kCtH55mcjrkSDXvQmAKeoU3LHDnmT9s4q RAWqbeT6E99nPsjq9wNk126ovi86v5spABMnO6fol3xAZ7jv+JmIrgk949SPt6OqLmS0 zR4PCTDrSUqKJBCRTibThODZHD9oEnCsMGBxWz0Nf1/FfGV2ZALn7TVI4V5/KjWTvl9j dSkiR9R1wfLXz/37IUvfay7VrupPHGIbKAn7Ms6TFgCOV+t28k0mArXIbqvDDaMKBILx VVIOpGH80ZCNrh2Rf/CuMhV/Mm3d5bTNI3pgfeVhwHEwRyIaXHZ2SbeapJcMB2HyelOz pAng== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from; bh=mN2e9UMiNeaZIqqCTjRh8dhCLbnvQyJqObt+DXSuxPw=; b=ZLl0epH1VKIUDlGbPY/WCQEWEIYq9ZT/Qhoi9INxgwAExEjjvE90pj7urUAGe+ae3S td3c9brd91CGBGksIwLUc4pG9HeNsvD0mTMv1f7FbenXS3ChJu5gkpGiw/RueurQAKuc WnFuejr4q7lEnVqtFiJkQvPhCNbPzk5IsGi3A6j0Q5FLieqxNtZToganYWAXYPQW1qDU YtLFiNwhIA7WDswJvMJh32nEyJDvkbdQV2vhoscPFqytKwSHIrDRdzfhxZGgPDdxY3DJ EWnFJT+rvGwOlwX4NcXKwZtoy7TNlSb2+qkSRNFrSsQi7wSz/CC12lk4o/gbnlJfKBqw i0dQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=huawei.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id d4-20020aa7ce04000000b00461b93cfe9dsi2538717edv.55.2022.11.17.23.37.40; Thu, 17 Nov 2022 23:38:04 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=huawei.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241239AbiKRHgx (ORCPT + 99 others); Fri, 18 Nov 2022 02:36:53 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51888 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240978AbiKRHgu (ORCPT ); Fri, 18 Nov 2022 02:36:50 -0500 Received: from szxga02-in.huawei.com (szxga02-in.huawei.com [45.249.212.188]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0D7DE85A3E; Thu, 17 Nov 2022 23:36:48 -0800 (PST) Received: from dggpemm500021.china.huawei.com (unknown [172.30.72.54]) by szxga02-in.huawei.com (SkyGuard) with ESMTP id 4ND7rD0tlDzHvsl; Fri, 18 Nov 2022 15:36:12 +0800 (CST) Received: from dggpemm100009.china.huawei.com (7.185.36.113) by dggpemm500021.china.huawei.com (7.185.36.109) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.31; Fri, 18 Nov 2022 15:36:44 +0800 Received: from huawei.com (10.175.113.32) by dggpemm100009.china.huawei.com (7.185.36.113) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.31; Fri, 18 Nov 2022 15:36:43 +0800 From: Liu Shixin To: Krzysztof Kozlowski , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni CC: , , Liu Shixin Subject: [PATCH] NFC: nci: fix memory leak in nci_rx_data_packet() Date: Fri, 18 Nov 2022 16:24:19 +0800 Message-ID: <20221118082419.239475-1-liushixin2@huawei.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 X-Originating-IP: [10.175.113.32] X-ClientProxiedBy: dggems705-chm.china.huawei.com (10.3.19.182) To dggpemm100009.china.huawei.com (7.185.36.113) X-CFilter-Loop: Reflected X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_MED, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1749818628665409714?= X-GMAIL-MSGID: =?utf-8?q?1749818628665409714?= Syzbot reported a memory leak about skb: unreferenced object 0xffff88810e144e00 (size 240): comm "syz-executor284", pid 3701, jiffies 4294952403 (age 12.620s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [] __alloc_skb+0x1f9/0x270 net/core/skbuff.c:497 [] alloc_skb include/linux/skbuff.h:1267 [inline] [] virtual_ncidev_write+0x24/0xe0 drivers/nfc/virtual_ncidev.c:116 [] do_loop_readv_writev fs/read_write.c:759 [inline] [] do_loop_readv_writev fs/read_write.c:743 [inline] [] do_iter_write+0x253/0x300 fs/read_write.c:863 [] vfs_writev+0xdd/0x240 fs/read_write.c:934 [] do_writev+0xa6/0x1c0 fs/read_write.c:977 [] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 [] entry_SYSCALL_64_after_hwframe+0x63/0xcd In nci_rx_data_packet(), if we don't get a valid conn_info, we will return directly but forget to release the skb. Reported-by: syzbot+cdb9a427d1bc08815104@syzkaller.appspotmail.com Fixes: 4aeee6871e8c ("NFC: nci: Add dynamic logical connections support") Signed-off-by: Liu Shixin --- net/nfc/nci/data.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/nfc/nci/data.c b/net/nfc/nci/data.c index aa5e712adf07..3d36ea5701f0 100644 --- a/net/nfc/nci/data.c +++ b/net/nfc/nci/data.c @@ -279,8 +279,10 @@ void nci_rx_data_packet(struct nci_dev *ndev, struct sk_buff *skb) nci_plen(skb->data)); conn_info = nci_get_conn_info_by_conn_id(ndev, nci_conn_id(skb->data)); - if (!conn_info) + if (!conn_info) { + kfree_skb(skb); return; + } /* strip the nci data header */ skb_pull(skb, NCI_DATA_HDR_SIZE);