Commit 0acf07d2 authored by Kees Cook's avatar Kees Cook Committed by David S. Miller

seccomp: fix memory leak on filter attach

This sets the correct error code when final filter memory is unavailable,
and frees the raw filter no matter what.

unreferenced object 0xffff8800d6ea4000 (size 512):
  comm "sshd", pid 278, jiffies 4294898315 (age 46.653s)
  hex dump (first 32 bytes):
    21 00 00 00 04 00 00 00 15 00 01 00 3e 00 00 c0  !...........>...
    06 00 00 00 00 00 00 00 21 00 00 00 00 00 00 00  ........!.......
  backtrace:
    [<ffffffff8151414e>] kmemleak_alloc+0x4e/0xb0
    [<ffffffff811a3a40>] __kmalloc+0x280/0x320
    [<ffffffff8110842e>] prctl_set_seccomp+0x11e/0x3b0
    [<ffffffff8107bb6b>] SyS_prctl+0x3bb/0x4a0
    [<ffffffff8152ef2d>] system_call_fastpath+0x1a/0x1f
    [<ffffffffffffffff>] 0xffffffffffffffff
Reported-by: default avatarMasami Ichikawa <masami256@gmail.com>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Tested-by: default avatarMasami Ichikawa <masami256@gmail.com>
Acked-by: default avatarDaniel Borkmann <dborkman@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent b7a31405
...@@ -255,6 +255,7 @@ static long seccomp_attach_filter(struct sock_fprog *fprog) ...@@ -255,6 +255,7 @@ static long seccomp_attach_filter(struct sock_fprog *fprog)
goto free_prog; goto free_prog;
/* Allocate a new seccomp_filter */ /* Allocate a new seccomp_filter */
ret = -ENOMEM;
filter = kzalloc(sizeof(struct seccomp_filter) + filter = kzalloc(sizeof(struct seccomp_filter) +
sizeof(struct sock_filter_int) * new_len, sizeof(struct sock_filter_int) * new_len,
GFP_KERNEL|__GFP_NOWARN); GFP_KERNEL|__GFP_NOWARN);
...@@ -264,6 +265,7 @@ static long seccomp_attach_filter(struct sock_fprog *fprog) ...@@ -264,6 +265,7 @@ static long seccomp_attach_filter(struct sock_fprog *fprog)
ret = sk_convert_filter(fp, fprog->len, filter->insnsi, &new_len); ret = sk_convert_filter(fp, fprog->len, filter->insnsi, &new_len);
if (ret) if (ret)
goto free_filter; goto free_filter;
kfree(fp);
atomic_set(&filter->usage, 1); atomic_set(&filter->usage, 1);
filter->len = new_len; filter->len = new_len;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment