FAILED: patch "[PATCH] can: j1939: j1939_session_destroy(): fix memory leak of skbs" failed to apply to 5.10-stable tree

PATCH [email protected] 1 participant 1 message Aug 22, 2022

Subsystems (3)

Stable branch CAN network layer CAN-J1939 network layer

lore

Share & tools

lore

[email protected]

author maintainer

2022-08-22 08:28 UTC #0 lore raw

The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 8c21c54a53ab21842f5050fa090f26b03c0313d6 Mon Sep 17 00:00:00 2001
From: Fedor Pchelkin <[email protected]>
Date: Fri, 5 Aug 2022 18:02:16 +0300
Subject: [PATCH] can: j1939: j1939_session_destroy(): fix memory leak of skbs

We need to drop skb references taken in j1939_session_skb_queue() when destroying a session in j1939_session_destroy(). Otherwise those skbs would be lost.

Link to Syzkaller info and repro: https://forge.ispras.ru/issues/11743.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

V1: https://lore.kernel.org/all/[email protected]

Fixes 9d71dd0c7009 ("can: add support of SAE J1939 protocol")

Signed-off-by Fedor Pchelkin <[email protected]>

Signed-off-by Alexey Khoroshilov <[email protected]>

Acked-by Oleksij Rempel <[email protected]>

Link https://lore.kernel.org/all/[email protected] open here

Signed-off-by Marc Kleine-Budde <[email protected]>

net/can/j1939/transport.c +7 -1

index 307ee1174a6e..d7d86c944d76 100644
@@ -260,6 +260,8 @@ static void __j1939_session_drop(struct j1939_session *session)
 
 static void j1939_session_destroy(struct j1939_session *session)
 {
+	struct sk_buff *skb;
+
 	if (session->transmission) {
 		if (session->err)
 			j1939_sk_errqueue(session, J1939_ERRQUEUE_TX_ABORT);

@@ -274,7 +276,11 @@ static void j1939_session_destroy(struct j1939_session *session)
 	WARN_ON_ONCE(!list_empty(&session->sk_session_queue_entry));
 	WARN_ON_ONCE(!list_empty(&session->active_session_list_entry));
 
-	skb_queue_purge(&session->skb_queue);
+	while ((skb = skb_dequeue(&session->skb_queue)) != NULL) {
+		/* drop ref taken in j1939_session_skb_queue() */
+		skb_unref(skb);
+		kfree_skb(skb);
+	}
 	__j1939_session_drop(session);
 	j1939_priv_put(session->priv);
 	kfree(session);