Commit 1c67cf44 authored by Eric Dumazet's avatar Eric Dumazet Committed by Kamal Mostafa

af_unix: fix struct pid memory leak

commit fa0dc04d upstream.

Dmitry reported a struct pid leak detected by a syzkaller program.

Bug happens in unix_stream_recvmsg() when we break the loop when a
signal is pending, without properly releasing scm.

Fixes: b3ca9b02 ("net: fix multithreaded signal handling in unix recv routines")
Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Cc: Rainer Weikusat <rweikusat@mobileactivedefense.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
[ luis: backported to 3.16:
  - use siocb->scm instead of &scm ]
Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
parent 6b64c944
...@@ -2147,6 +2147,7 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock, ...@@ -2147,6 +2147,7 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
if (signal_pending(current)) { if (signal_pending(current)) {
err = sock_intr_errno(timeo); err = sock_intr_errno(timeo);
scm_destroy(siocb->scm);
goto out; goto out;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment