Subject: Re: [syzbot] memory leak in xfrm_user_rcv_msg

From: Pavel Skripkin <[email-masked]>
Date: Thu, 24 Jun 2021 22:12:44 +0300

On Tue, 22 Jun 2021 12:04:23 -0700
syzbot <[email-masked]> wrote:

> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    fd0aa1a4 Merge tag 'for-linus' of
> git://git.kernel.org/pub.. git tree:       upstream
> console output:
> https://syzkaller.appspot.com/x/log.txt?x=17464aa4300000 kernel
> config:  https://syzkaller.appspot.com/x/.config?x=6ec2526c74098317
> dashboard link:
> https://syzkaller.appspot.com/bug?extid=fb347cf82c73a90efcca syz
> repro:
> https://syzkaller.appspot.com/x/repro.syz?x=14946548300000 C
> reproducer:   https://syzkaller.appspot.com/x/repro.c?x=10d28548300000
> 
> IMPORTANT: if you fix the issue, please add the following tag to the
> commit: Reported-by:
> [email-masked]
> 

#syz test
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

With regards,
Pavel Skripkin
>From 6c124b1a50375215dcb6fae3f443a70340af1d47 Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <[email-masked]>
Date: Thu, 24 Jun 2021 22:10:25 +0300
Subject: [PATCH] net: xfrm: fix memory leak in xfrm_user_rcv_msg

/* ...... */

Signed-off-by: Pavel Skripkin <[email-masked]>
---
 net/xfrm/xfrm_user.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index f0aecee4d539..ff60ff804074 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -2811,6 +2811,16 @@ static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
 
 	err = link->doit(skb, nlh, attrs);
 
+	/* We need to free skb allocated in xfrm_alloc_compat() before
+	 * returning from this function, because consume_skb() won't take
+	 * care of frag_list since netlink destructor sets
+	 * sbk->head to NULL. (see netlink_skb_destructor())
+	 */
+	if (skb_has_frag_list(skb)) {
+		kfree_skb(skb_shinfo(skb)->frag_list);
+		skb_shinfo(skb)->frag_list = NULL;
+	}
+
 err:
 	kvfree(nlh64);
 	return err;
-- 
2.32.0