[PATCH v1 net] af_unix: Fix memory leaks of the whole sk due to OOB skb.

7 views
Skip to first unread message

Kuniyuki Iwashima

unread,
Sep 29, 2022, 11:52:54 AMSep 29
to David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni, Rao Shoaib, Kuniyuki Iwashima, Kuniyuki Iwashima, net...@vger.kernel.org, syzbot
syzbot reported a sequence of memory leaks, and one of them indicated we
failed to free a whole sk:

unreferenced object 0xffff8880126e0000 (size 1088):
comm "syz-executor419", pid 326, jiffies 4294773607 (age 12.609s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 7d 00 00 00 00 00 00 00 ........}.......
01 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............
backtrace:
[<000000006fefe750>] sk_prot_alloc+0x64/0x2a0 net/core/sock.c:1970
[<0000000074006db5>] sk_alloc+0x3b/0x800 net/core/sock.c:2029
[<00000000728cd434>] unix_create1+0xaf/0x920 net/unix/af_unix.c:928
[<00000000a279a139>] unix_create+0x113/0x1d0 net/unix/af_unix.c:997
[<0000000068259812>] __sock_create+0x2ab/0x550 net/socket.c:1516
[<00000000da1521e1>] sock_create net/socket.c:1566 [inline]
[<00000000da1521e1>] __sys_socketpair+0x1a8/0x550 net/socket.c:1698
[<000000007ab259e1>] __do_sys_socketpair net/socket.c:1751 [inline]
[<000000007ab259e1>] __se_sys_socketpair net/socket.c:1748 [inline]
[<000000007ab259e1>] __x64_sys_socketpair+0x97/0x100 net/socket.c:1748
[<000000007dedddc1>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<000000007dedddc1>] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80
[<000000009456679f>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

We can reproduce this issue by creating two AF_UNIX SOCK_STREAM sockets,
send()ing an OOB skb to each other, and close()ing them without consuming
the OOB skbs.

int skpair[2];

socketpair(AF_UNIX, SOCK_STREAM, 0, skpair);

send(skpair[0], "x", 1, MSG_OOB);
send(skpair[1], "x", 1, MSG_OOB);

close(skpair[0]);
close(skpair[1]);

Currently, we free an OOB skb in unix_sock_destructor() which is called via
__sk_free(), but it's too late because the receiver's unix_sk(sk)->oob_skb
is accounted against the sender's sk->sk_wmem_alloc and __sk_free() is
called only when sk->sk_wmem_alloc is 0.

In the repro sequences, we do not consume the OOB skb, so both two sk's
sock_put() never reach __sk_free() due to the positive sk->sk_wmem_alloc.
Then, no one can consume the OOB skb nor call __sk_free(), and we finally
leak the two whole sk.

Thus, we must free the unconsumed OOB skb earlier when close()ing the
socket.

Fixes: 314001f0bf92 ("af_unix: Add OOB support")
Reported-by: syzbot <syzk...@googlegroups.com>
Signed-off-by: Kuniyuki Iwashima <kun...@amazon.com>
---
net/unix/af_unix.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index bf338b782fc4..d686804119c9 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -569,12 +569,6 @@ static void unix_sock_destructor(struct sock *sk)

skb_queue_purge(&sk->sk_receive_queue);

-#if IS_ENABLED(CONFIG_AF_UNIX_OOB)
- if (u->oob_skb) {
- kfree_skb(u->oob_skb);
- u->oob_skb = NULL;
- }
-#endif
DEBUG_NET_WARN_ON_ONCE(refcount_read(&sk->sk_wmem_alloc));
DEBUG_NET_WARN_ON_ONCE(!sk_unhashed(sk));
DEBUG_NET_WARN_ON_ONCE(sk->sk_socket);
@@ -620,6 +614,13 @@ static void unix_release_sock(struct sock *sk, int embrion)

unix_state_unlock(sk);

+#if IS_ENABLED(CONFIG_AF_UNIX_OOB)
+ if (u->oob_skb) {
+ kfree_skb(u->oob_skb);
+ u->oob_skb = NULL;
+ }
+#endif
+
wake_up_interruptible_all(&u->peer_wait);

if (skpair != NULL) {
--
2.30.2

patchwork-b...@kernel.org

unread,
Oct 3, 2022, 3:10:18 AMOct 3
to Kuniyuki Iwashima, da...@davemloft.net, edum...@google.com, ku...@kernel.org, pab...@redhat.com, rao.s...@oracle.com, kuni...@gmail.com, net...@vger.kernel.org, syzk...@googlegroups.com
Hello:

This patch was applied to netdev/net.git (master)
by David S. Miller <da...@davemloft.net>:

On Thu, 29 Sep 2022 08:52:04 -0700 you wrote:
> syzbot reported a sequence of memory leaks, and one of them indicated we
> failed to free a whole sk:
>
> unreferenced object 0xffff8880126e0000 (size 1088):
> comm "syz-executor419", pid 326, jiffies 4294773607 (age 12.609s)
> hex dump (first 32 bytes):
> 00 00 00 00 00 00 00 00 7d 00 00 00 00 00 00 00 ........}.......
> 01 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............
> backtrace:
> [<000000006fefe750>] sk_prot_alloc+0x64/0x2a0 net/core/sock.c:1970
> [<0000000074006db5>] sk_alloc+0x3b/0x800 net/core/sock.c:2029
> [<00000000728cd434>] unix_create1+0xaf/0x920 net/unix/af_unix.c:928
> [<00000000a279a139>] unix_create+0x113/0x1d0 net/unix/af_unix.c:997
> [<0000000068259812>] __sock_create+0x2ab/0x550 net/socket.c:1516
> [<00000000da1521e1>] sock_create net/socket.c:1566 [inline]
> [<00000000da1521e1>] __sys_socketpair+0x1a8/0x550 net/socket.c:1698
> [<000000007ab259e1>] __do_sys_socketpair net/socket.c:1751 [inline]
> [<000000007ab259e1>] __se_sys_socketpair net/socket.c:1748 [inline]
> [<000000007ab259e1>] __x64_sys_socketpair+0x97/0x100 net/socket.c:1748
> [<000000007dedddc1>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> [<000000007dedddc1>] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80
> [<000000009456679f>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
>
> [...]

Here is the summary with links:
- [v1,net] af_unix: Fix memory leaks of the whole sk due to OOB skb.
https://git.kernel.org/netdev/net/c/7a62ed61367b

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html


Reply all
Reply to author
Forward
0 new messages