mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-28 21:33:52 +00:00
Code Issues Releases Wiki Activity
No description
1127135 commits 105 branches 5097 tags 5.5 GiB
C 97.6%
Assembly 1%
Shell 0.5%
Python 0.3%
Makefile 0.3%
Find a file
Eric Dumazet 8c330c36b3 net: stream: purge sk_error_queue in sk_stream_kill_queues() 
[ Upstream commit e0c8bccd40 ]

Changheon Lee reported TCP socket leaks, with a nice repro.

It seems we leak TCP sockets with the following sequence:

1) SOF_TIMESTAMPING_TX_ACK is enabled on the socket.

   Each ACK will cook an skb put in error queue, from __skb_tstamp_tx().
   __skb_tstamp_tx() is using skb_clone(), unless
   SOF_TIMESTAMPING_OPT_TSONLY was also requested.

2) If the application is also using MSG_ZEROCOPY, then we put in the
   error queue cloned skbs that had a struct ubuf_info attached to them.

   Whenever an struct ubuf_info is allocated, sock_zerocopy_alloc()
   does a sock_hold().

   As long as the cloned skbs are still in sk_error_queue,
   socket refcount is kept elevated.

3) Application closes the socket, while error queue is not empty.

Since tcp_close() no longer purges the socket error queue,
we might end up with a TCP socket with at least one skb in
error queue keeping the socket alive forever.

This bug can be (ab)used to consume all kernel memory
and freeze the host.

We need to purge the error queue, with proper synchronization
against concurrent writers.

Fixes: 24bcbe1cc6 ("net: stream: don't purge sk_error_queue in sk_stream_kill_queues()")
Reported-by: Changheon Lee <darklight2357@icloud.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-12-31 13:26:39 +01:00
arch arm64: dts: mt8183: Fix Mali GPU clock 2022-12-31 13:26:39 +01:00
block block, bfq: fix possible uaf for 'bfqq->bic' 2022-12-31 13:26:37 +01:00
certs
crypto crypto: tcrypt - Fix multibuffer skcipher speed test mem leak 2022-12-31 13:26:20 +01:00
Documentation dt-bindings: mfd: qcom,spmi-pmic: Drop PWM reg dependency 2022-12-31 13:26:36 +01:00
drivers myri10ge: Fix an error handling path in myri10ge_probe() 2022-12-31 13:26:39 +01:00
fs nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure 2022-12-31 13:26:37 +01:00
include dmaengine: idxd: Fix crc_val field for completion record 2022-12-31 13:26:32 +01:00
init
io_uring
ipc ipc: fix memory leak in init_mqueue_fs() 2022-12-31 13:25:48 +01:00
kernel bpf: prevent leak of lsm program after failed attach 2022-12-31 13:26:37 +01:00
lib test_firmware: fix memory leak in test_firmware_init() 2022-12-31 13:26:26 +01:00
LICENSES
mm
net net: stream: purge sk_error_queue in sk_stream_kill_queues() 2022-12-31 13:26:39 +01:00
samples samples: vfio-mdev: Fix missing pci_disable_device() in mdpy_fb_probe() 2022-12-31 13:26:28 +01:00
scripts
security apparmor: Fix memleak in alloc_ns() 2022-12-31 13:26:17 +01:00
sound ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt 2022-12-31 13:26:09 +01:00
tools selftests: devlink: fix the fd redirect in dummy_reporter_test 2022-12-31 13:26:38 +01:00
usr
virt
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile
README

README 

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.