• Zhengchao Shao's avatar
    sctp: fix memory leak in sctp_stream_outq_migrate() · 9ed7bfc7
    Zhengchao Shao authored
    When sctp_stream_outq_migrate() is called to release stream out resources,
    the memory pointed to by prio_head in stream out is not released.
    
    The memory leak information is as follows:
     unreferenced object 0xffff88801fe79f80 (size 64):
       comm "sctp_repo", pid 7957, jiffies 4294951704 (age 36.480s)
       hex dump (first 32 bytes):
         80 9f e7 1f 80 88 ff ff 80 9f e7 1f 80 88 ff ff  ................
         90 9f e7 1f 80 88 ff ff 90 9f e7 1f 80 88 ff ff  ................
       backtrace:
         [<ffffffff81b215c6>] kmalloc_trace+0x26/0x60
         [<ffffffff88ae517c>] sctp_sched_prio_set+0x4cc/0x770
         [<ffffffff88ad64f2>] sctp_stream_init_ext+0xd2/0x1b0
         [<ffffffff88aa2604>] sctp_sendmsg_to_asoc+0x1614/0x1a30
         [<ffffffff88ab7ff1>] sctp_sendmsg+0xda1/0x1ef0
         [<ffffffff87f765ed>] inet_sendmsg+0x9d/0xe0
         [<ffffffff8754b5b3>] sock_sendmsg+0xd3/0x120
         [<ffffffff8755446a>] __sys_sendto+0x23a/0x340
         [<ffffffff87554651>] __x64_sys_sendto+0xe1/0x1b0
         [<ffffffff89978b49>] do_syscall_64+0x39/0xb0
         [<ffffffff89a0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
    
    Link: https://syzkaller.appspot.com/bug?exrid=29c402e56c4760763cc0
    Fixes: 637784ad ("sctp: introduce priority based stream scheduler")
    Reported-by: syzbot+29c402e56c4760763cc0@syzkaller.appspotmail.com
    Signed-off-by: default avatarZhengchao Shao <shaozhengchao@huawei.com>
    Reviewed-by: default avatarXin Long <lucien.xin@gmail.com>
    Link: https://lore.kernel.org/r/20221126031720.378562-1-shaozhengchao@huawei.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
    9ed7bfc7
stream.c 26.6 KB