• Pavel Skripkin's avatar
    net: qrtr: fix memory leaks · 52f3456a
    Pavel Skripkin authored
    Syzbot reported memory leak in qrtr. The problem was in unputted
    struct sock. qrtr_local_enqueue() function calls qrtr_port_lookup()
    which takes sock reference if port was found. Then there is the following
    check:
    
    if (!ipc || &ipc->sk == skb->sk) {
    	...
    	return -ENODEV;
    }
    
    Since we should drop the reference before returning from this function and
    ipc can be non-NULL inside this if, we should add qrtr_port_put() inside
    this if.
    
    The similar corner case is in qrtr_endpoint_post() as Manivannan
    reported. In case of sock_queue_rcv_skb() failure we need to put
    port reference to avoid leaking struct sock pointer.
    
    Fixes: e04df98a ("net: qrtr: Remove receive worker")
    Fixes: bdabad3e ("net: Add Qualcomm IPC router")
    Reported-and-tested-by: syzbot+35a511c72ea7356cdcf3@syzkaller.appspotmail.com
    Signed-off-by: default avatarPavel Skripkin <paskripkin@gmail.com>
    Reviewed-by: default avatarManivannan Sadhasivam <mani@kernel.org>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    52f3456a
qrtr.c 30.1 KB