Zhengchao Shao 176ee6c673 sctp: fix memory leak in sctp_stream_outq_migrate() ...

[ Upstream commit 9ed7bfc79542119ac0a9e1ce8a2a5285e43433e9 ]

When sctp_stream_outq_migrate() is called to release stream out resources,
the memory pointed to by prio_head in stream out is not released.

The memory leak information is as follows:
 unreferenced object 0xffff88801fe79f80 (size 64):
   comm "sctp_repo", pid 7957, jiffies 4294951704 (age 36.480s)
   hex dump (first 32 bytes):
     80 9f e7 1f 80 88 ff ff 80 9f e7 1f 80 88 ff ff  ................
     90 9f e7 1f 80 88 ff ff 90 9f e7 1f 80 88 ff ff  ................
   backtrace:
     [<ffffffff81b215c6>] kmalloc_trace+0x26/0x60
     [<ffffffff88ae517c>] sctp_sched_prio_set+0x4cc/0x770
     [<ffffffff88ad64f2>] sctp_stream_init_ext+0xd2/0x1b0
     [<ffffffff88aa2604>] sctp_sendmsg_to_asoc+0x1614/0x1a30
     [<ffffffff88ab7ff1>] sctp_sendmsg+0xda1/0x1ef0
     [<ffffffff87f765ed>] inet_sendmsg+0x9d/0xe0
     [<ffffffff8754b5b3>] sock_sendmsg+0xd3/0x120
     [<ffffffff8755446a>] __sys_sendto+0x23a/0x340
     [<ffffffff87554651>] __x64_sys_sendto+0xe1/0x1b0
     [<ffffffff89978b49>] do_syscall_64+0x39/0xb0
     [<ffffffff89a0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

Link: https://syzkaller.appspot.com/bug?exrid=29c402e56c4760763cc0
Fixes: 637784ade2 ("sctp: introduce priority based stream scheduler")
Reported-by: syzbot+29c402e56c4760763cc0@syzkaller.appspotmail.com
Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
Reviewed-by: Xin Long <lucien.xin@gmail.com>
Link: https://lore.kernel.org/r/20221126031720.378562-1-shaozhengchao@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2022-12-08 11:23:57 +01:00

..

associola.c

sctp: leave the err path free in sctp_stream_init to sctp_stream_free

2022-08-03 12:00:49 +02:00

auth.c

sctp: handle the error returned from sctp_auth_asoc_init_active_key

2022-10-26 13:25:23 +02:00

bind_addr.c

sctp: validate from_addr_param return

2021-07-19 09:44:55 +02:00

chunk.c

net: sctp: chunk.c: delete duplicated word

2020-08-24 16:21:43 -07:00

debug.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 104

2019-05-24 17:39:00 +02:00

diag.c

sctp: fix kernel-infoleak for SCTP sockets

2022-03-16 14:15:59 +01:00

endpointola.c

sctp: use call_rcu to free endpoint

2022-01-05 12:40:30 +01:00

input.c

sctp: read sk->sk_bound_dev_if once in sctp_rcv()

2022-06-09 10:21:09 +02:00

inqueue.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 104

2019-05-24 17:39:00 +02:00

ipv6.c

sctp: validate from_addr_param return

2021-07-19 09:44:55 +02:00

Kconfig

treewide: replace '---help---' in Kconfig files with 'help'

2020-06-14 01:57:21 +09:00

Makefile

sctp: rename sctp_diag.c as diag.c

2018-02-13 13:56:31 -05:00

objcnt.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 104

2019-05-24 17:39:00 +02:00

offload.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2019-06-07 11:00:14 -07:00

output.c

sctp: get netns from asoc and ep base

2019-12-09 20:14:01 -08:00

outqueue.c

sctp: clear out_curr if all frag chunks of current msg are pruned

2022-11-25 17:45:43 +01:00

primitive.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 104

2019-05-24 17:39:00 +02:00

proc.c

net: fix iteration for sctp transport seq_files

2021-02-17 11:02:29 +01:00

protocol.c

ip: Fix data-races around sysctl_ip_nonlocal_bind.

2022-07-29 17:19:12 +02:00

sm_make_chunk.c

sctp: account stream padding length for reconf chunk

2021-10-20 11:45:03 +02:00

sm_sideeffect.c

sctp: check asoc strreset_chunk in sctp_generate_reconf_event

2022-05-09 09:05:03 +02:00

sm_statefuns.c

sctp: fix the processing for INIT chunk

2022-03-19 13:44:42 +01:00

sm_statetable.c

sctp: remove net sctp.x_enable working as a global switch

2019-08-19 18:27:29 -07:00

socket.c

sctp: Initialize daddr on peeled off socket

2022-04-20 09:23:17 +02:00

stream_interleave.c

sctp: get netns from asoc and ep base

2019-12-09 20:14:01 -08:00

stream_sched_prio.c

sctp: fix memory leak in sctp_stream_outq_migrate()

2022-12-08 11:23:57 +01:00

stream_sched_rr.c

sctp: fix memory leak in sctp_stream_outq_migrate()

2022-12-08 11:23:57 +01:00

stream_sched.c

sctp: fix memory leak in sctp_stream_outq_migrate()

2022-12-08 11:23:57 +01:00

stream.c

sctp: fix memory leak in sctp_stream_outq_migrate()

2022-12-08 11:23:57 +01:00

sysctl.c

sysctl: pass kernel pointers to ->proc_handler

2020-04-27 02:07:40 -04:00

transport.c

sctp: change to hold/put transport for proto_unreach_timer

2020-11-14 11:57:12 -08:00

tsnmap.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 104

2019-05-24 17:39:00 +02:00

ulpevent.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2020-05-31 17:48:46 -07:00

ulpqueue.c

net: sctp: ulpqueue.c: delete duplicated word

2020-08-24 16:21:43 -07:00