kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-24 19:10:26 +00:00
Code Issues Releases Packages Activity
linux/drivers
History
Gavrilov Ilia 5fbbd952e7 pppoe: Fix memory leak in pppoe_sendmsg() 
[ Upstream commit dc34ebd5c0 ]

syzbot reports a memory leak in pppoe_sendmsg [1].

The problem is in the pppoe_recvmsg() function that handles errors
in the wrong order. For the skb_recv_datagram() function, check
the pointer to skb for NULL first, and then check the 'error' variable,
because the skb_recv_datagram() function can set 'error'
to -EAGAIN in a loop but return a correct pointer to socket buffer
after a number of attempts, though 'error' remains set to -EAGAIN.

skb_recv_datagram
      __skb_recv_datagram          // Loop. if (err == -EAGAIN) then
                                   // go to the next loop iteration
          __skb_try_recv_datagram  // if (skb != NULL) then return 'skb'
                                   // else if a signal is received then
                                   // return -EAGAIN

Found by InfoTeCS on behalf of Linux Verification Center
(linuxtesting.org) with Syzkaller.

Link: https://syzkaller.appspot.com/bug?extid=6bdfd184eac7709e5cc9 [1]

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: syzbot+6bdfd184eac7709e5cc9@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6bdfd184eac7709e5cc9
Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
Reviewed-by: Guillaume Nault <gnault@redhat.com>
Link: https://lore.kernel.org/r/20240214085814.3894917-1-Ilia.Gavrilov@infotecs.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2024-08-19 06:04:27 +02:00
..
accel kthread: add kthread_stop_put 2024-06-12 11:12:52 +02:00
accessibility speakup: Fix sizeof() vs ARRAY_SIZE() bug 2024-06-12 11:11:18 +02:00
acpi ACPI: SBS: manage alarm sysfs attribute through psy core 2024-08-14 13:58:42 +02:00
amba amba: bus: fix refcount leak 2023-08-22 15:50:57 +02:00
android binder: fix hang of unregistered readers 2024-08-03 08:54:21 +02:00
ata ata: libata-scsi: Honor the D_SENSE bit for CK_COND=1 and no error 2024-08-03 08:54:15 +02:00
atm atm: idt77252: fix a memleak in open_card_ubr0 2024-02-16 19:10:49 +01:00
auxdisplay auxdisplay: ht16k33: Drop reference after LED registration 2024-08-03 08:54:39 +02:00
base driver core: Fix uevent_show() vs driver detach race 2024-08-14 13:58:56 +02:00
bcma bcma: Add explicit of_device.h include 2023-04-14 15:32:56 +03:00
block rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings 2024-08-03 08:54:32 +02:00
bluetooth Bluetooth: btnxpuart: Shutdown timer and prevent rearming when driver unloading 2024-08-14 13:58:44 +02:00
bus bus: mhi: host: Add MHI_PM_SYS_ERR_FAIL state 2024-04-13 13:07:38 +02:00
cache cache: ax45mp_cache: Align end size to cache boundary in ax45mp_dma_cache_wback() 2024-03-01 13:35:08 +01:00
cdrom cdrom: rearrange last_media_change check to avoid unintentional overflow 2024-07-11 12:49:10 +02:00
cdx cdx: Explicitly include correct DT includes 2023-08-04 16:21:20 +02:00
char hwrng: amd - Convert PCIBIOS_* return codes to errnos 2024-08-03 08:54:21 +02:00
clk clk: davinci: da8xx-cfgchip: Initialize clk_init_data before use 2024-08-03 08:54:23 +02:00
clocksource clocksource/drivers/sh_cmt: Address race condition for clock events 2024-08-14 13:58:41 +02:00
comedi comedi: vmk80xx: fix incomplete endpoint checking 2024-04-27 17:11:39 +02:00
connector connector/cn_proc: revert "connector: Fix proc_event_num_listeners count not cleared" 2024-02-23 09:25:01 +01:00
counter counter: ti-eqep: enable clock at probe 2024-07-05 09:33:56 +02:00
cpufreq cpufreq: qcom-nvmem: fix memory leaks in probe error paths 2024-08-11 12:47:14 +02:00
cpuidle cpuidle: Avoid potential overflow in integer multiplication 2024-04-13 13:07:29 +02:00
crypto crypto: qat - extend scope of lock in adf_cfg_add_key_value_param() 2024-08-03 08:54:01 +02:00
cxl cxl/region: check interleave capability 2024-07-05 09:34:07 +02:00
dax mm: remove enum page_entry_size 2023-08-24 16:20:30 -07:00
dca Mainly singleton patches all over the place. Series of note are: 2023-04-27 19:57:00 -07:00
devfreq PM / devfreq: Synchronize devfreq_monitor_[start/stop] 2024-02-05 20:14:15 +00:00
dio drivers: dio: fix possible memory leak in dio_init() 2022-11-09 15:12:37 +01:00
dma dmaengine: fsl-edma: change the memory access from local into remote mode in i.MX 8QM 2024-08-11 12:47:17 +02:00
dma-buf dma-buf: handle testing kthreads creation failure 2024-06-21 14:38:40 +02:00
edac EDAC, i10nm: make skx_common.o a separate module 2024-08-03 08:53:19 +02:00
eisa EISA: Replace all non-returning strlcpy with strscpy 2023-07-27 10:04:42 -07:00
extcon extcon: max8997: select IRQ_DOMAIN instead of depending on it 2024-06-12 11:12:27 +02:00
firewire firewire: ohci: fulfill timestamp for some local asynchronous transaction 2024-05-17 12:02:30 +02:00
firmware firmware/sysfb: Update screen_info for relocated EFI framebuffers 2024-08-11 12:47:16 +02:00
fpga fpga: region: add owner module and take its refcount 2024-06-12 11:12:23 +02:00
fsi fsi: i2cr: Switch to use struct i2c_driver's .probe() 2023-08-22 15:51:33 +02:00
gnss driver core: class: remove module * from class_create() 2023-03-17 15:16:33 +01:00
gpio gpio: prevent potential speculation leaks in gpio_device_get_desc() 2024-08-14 13:58:40 +02:00
gpu nouveau: set placement to original placement on uvmm validate. 2024-08-14 13:59:03 +02:00
greybus greybus: Fix use-after-free bug in gb_interface_release due to race condition. 2024-06-21 14:38:48 +02:00
hid HID: wacom: Modify pen IDs 2024-08-11 12:47:24 +02:00
hsi hsi: omap_ssi: Explicitly include correct DT includes 2023-07-31 23:17:57 +02:00
hte hte: tegra: Fix missing error code in tegra_hte_test_probe() 2023-11-20 11:59:08 +01:00
hv Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted 2024-05-17 12:02:17 +02:00
hwmon hwmon: corsair-psu: add USB id of HX1200i Series 2023 psu 2024-08-14 13:58:41 +02:00
hwspinlock hwspinlock: qcom: add missing regmap config for SFPB MMIO implementation 2023-07-17 11:49:18 -07:00
hwtracing coresight: Fix ref leak when of_coresight_parse_endpoint() fails 2024-08-03 08:53:57 +02:00
i2c i2c: qcom-geni: Add missing geni_icc_disable in geni_i2c_runtime_resume 2024-08-14 13:58:52 +02:00
i3c i3c: master: svc: fix invalidate IBI type and miss call client IBI handler 2024-06-16 13:47:46 +02:00
idle x86: Fix CPUIDLE_FLAG_IRQ_ENABLE leaking timer reprogram 2024-01-25 15:35:12 -08:00
iio iio: frequency: adrf6780: rm clk provider include 2024-08-03 08:53:56 +02:00
infiniband RDMA/iwcm: Fix a use-after-free related to destroying CM IDs 2024-08-03 08:54:30 +02:00
input Input: bcm5974 - check endpoint type before starting traffic 2024-08-19 06:04:26 +02:00
interconnect interconnect: qcom: qcm2290: Fix mas_snoc_bimc RPM master ID 2024-08-03 08:53:58 +02:00
iommu iommu: sprd: Avoid NULL deref in sprd_iommu_hw_en 2024-08-03 08:54:41 +02:00
ipack tty: make tty_operations::write()'s count size_t 2023-08-11 21:12:46 +02:00
irqchip irqchip/xilinx: Fix shift out of bounds 2024-08-14 13:58:58 +02:00
isdn mISDN: Fix a use after free in hfcmulti_tx() 2024-08-03 08:54:38 +02:00
leds leds: triggers: Flush pending brightness before activating trigger 2024-08-11 12:47:14 +02:00
macintosh macintosh/therm_windtunnel: fix module unload. 2024-08-03 08:54:02 +02:00
mailbox mailbox: arm_mhuv2: Fix a bug for mhuv2_sender_interrupt 2024-02-05 20:14:31 +00:00
mcb mcb: fix error handling for different scenarios when parsing 2023-11-28 17:20:05 +00:00
md md/raid5: avoid BUG_ON() while continue reshape after reassembling 2024-08-14 13:58:41 +02:00
media media: xc2028: avoid use-after-free in load_firmware_cb() 2024-08-14 13:58:46 +02:00
memory memory: fsl_ifc: Make FSL_IFC config visible and selectable 2024-08-03 08:53:27 +02:00
memstick memstick r592: make memstick_debug_get_tpc_name() static 2023-06-12 15:16:19 +02:00
message scsi: message: fusion: Add HAS_IOPORT dependencies 2023-05-31 19:59:26 -04:00
mfd mfd: omap-usb-tll: Use struct_size to allocate tll 2024-08-03 08:53:54 +02:00
misc mei: demote client disconnect warning on suspend to debug 2024-07-25 09:50:45 +02:00
mmc mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro() 2024-07-05 09:33:55 +02:00
most staging: most: Replace all non-returning strlcpy with strscpy 2023-06-01 07:07:37 -07:00
mtd ubi: eba: properly rollback inside self_check_eba 2024-08-03 08:54:23 +02:00
mux mux: Explicitly include correct DT includes 2023-08-28 13:36:24 -05:00
net pppoe: Fix memory leak in pppoe_sendmsg() 2024-08-19 06:04:27 +02:00
nfc nfc/nci: Add the inconsistency check between the input data length and count 2024-07-11 12:49:21 +02:00
ntb NTB: fix possible name leak in ntb_register_device() 2024-03-26 18:19:48 -04:00
nubus nubus: Don't list slot resources by default 2023-05-22 13:51:56 +02:00
nvdimm nd_btt: Make BTT lanes preemptible 2023-11-20 11:59:19 +01:00
nvme nvme/pci: Add APST quirk for Lenovo N60z laptop 2024-08-19 06:04:24 +02:00
nvmem nvmem: rockchip-otp: set add_legacy_fixed_of_cells config option 2024-08-03 08:54:01 +02:00
of of/irq: Disable "interrupt-map" parsing for PASEMI Nemo 2024-07-25 09:50:57 +02:00
opp OPP: ti: Fix ti_opp_supply_probe wrong return values 2024-08-03 08:53:27 +02:00
parisc parisc/power: Fix power soft-off button emulation on qemu 2024-01-31 16:18:52 -08:00
parport dev/parport: fix the array out-of-bounds risk 2024-08-03 08:54:22 +02:00
pci PCI: Add pci_get_base_class() helper 2024-08-11 12:47:15 +02:00
pcmcia pcmcia: ds: fix possible name leak in error path in pcmcia_device_add() 2023-11-20 11:59:31 +01:00
peci Update peci-next for v6.6-rc1 2023-08-08 10:53:30 +02:00
perf perf: riscv: Fix selecting counters in legacy mode 2024-08-11 12:47:23 +02:00
phy phy: zynqmp: Enable reference clock correctly 2024-08-03 08:54:35 +02:00
pinctrl pinctrl: renesas: r8a779g0: Fix TPU suffixes 2024-08-03 08:54:09 +02:00
platform platform/x86/intel/ifs: Initialize union ifs_status to zero 2024-08-14 13:58:38 +02:00
pmdomain pmdomain: qcom: rpmhpd: Skip retention level for Power Domains 2024-07-18 13:21:22 +02:00
pnp PNP: ACPI: fix fortify warning 2024-02-05 20:14:15 +00:00
power power: supply: axp288_charger: Round constant_charge_voltage writes down 2024-08-14 13:58:58 +02:00
powercap powercap: intel_rapl_tpmi: Fix System Domain probing 2024-04-03 15:28:19 +02:00
pps driver core: class: remove module * from class_create() 2023-03-17 15:16:33 +01:00
ps3 driver/ps3: Include <video/cmdline.h> for mode parsing 2023-02-20 14:56:51 +01:00
ptp ptp: fix integer overflow in max_vclocks_store 2024-06-27 13:49:07 +02:00
pwm pwm: atmel-tcb: Fix race condition and convert to guards 2024-08-03 08:53:23 +02:00
rapidio Mainly singleton patches all over the place. Series of note are: 2023-04-27 19:57:00 -07:00
ras ras/debugfs: Fix error checking for debugfs_create_dir() 2023-05-16 21:12:23 +02:00
regulator regulator: bd71815: fix ramp values 2024-06-27 13:49:09 +02:00
remoteproc remoteproc: imx_rproc: Fix refcount mistake in imx_rproc_addr_init 2024-08-03 08:54:31 +02:00
reset reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning 2024-01-20 11:51:44 +01:00
rpmsg rpmsg: virtio: Free driver_override when rpmsg_remove() 2024-01-31 16:18:50 -08:00
rtc rtc: abx80x: Fix return value of nvmem callback on read 2024-08-03 08:54:29 +02:00
s390 s390/sclp: Prevent release of buffer in I/O 2024-08-14 13:58:47 +02:00
sbus sbus: Explicitly include correct DT includes 2023-08-28 13:36:24 -05:00
scsi scsi: mpi3mr: Avoid IOMMU page faults on REPORT ZONES 2024-08-14 13:58:55 +02:00
sh sh: intc: move to use bus_get_dev_root() 2023-03-17 15:29:55 +01:00
siox siox: fix possible memory leak in siox_device_add() 2022-11-09 15:40:14 +01:00
slimbus slimbus: qcom-ngd-ctrl: Add timeout for wait operation 2024-05-17 12:02:33 +02:00
soc drivers: soc: xilinx: check return status of get_api_version() 2024-08-03 08:54:18 +02:00
soundwire soundwire: cadence: fix invalid PDI offset 2024-06-12 11:12:15 +02:00
spi spi: spi-fsl-lpspi: Fix scldiv calculation 2024-08-14 13:58:52 +02:00
spmi spmi: hisi-spmi-controller: Do not override device identifier 2024-06-21 14:38:40 +02:00
ssb ssb: Fix potential NULL pointer dereference in ssb_device_uevent() 2024-06-27 13:49:01 +02:00
staging greybus: arche-ctrl: move device table to its right location 2024-06-12 11:12:17 +02:00
target scsi: target: Fix SELinux error when systemd-modules loads the target module 2024-05-17 12:02:15 +02:00
tc The main MIPS changes for 5.6: 2020-01-31 11:28:31 -08:00
tee tee: optee: ffa: Fix missing-field-initializers warning 2024-07-25 09:50:53 +02:00
thermal thermal/drivers/broadcom: Fix race between removal and clock disable 2024-08-11 12:47:12 +02:00
thunderbolt thunderbolt: debugfs: Fix margin debugfs node creation condition 2024-06-21 14:38:25 +02:00
tty serial: core: check uartclk for zero to avoid divide by zero 2024-08-14 13:58:57 +02:00
ufs scsi: ufs: core: Fix hba->last_dme_cmd_tstamp timestamp updating logic 2024-08-14 13:58:55 +02:00
uio uio_hv_generic: Don't free decrypted memory 2024-05-17 12:02:17 +02:00
usb usb: gadget: u_audio: Check return codes from usb_ep_enable and config_ep_by_speed. 2024-08-14 13:58:55 +02:00
vdpa vduse: Temporarily fail if control queue feature requested 2024-07-05 09:33:50 +02:00
vfio vfio/pci: Init the count variable in collecting hot-reset devices 2024-07-18 13:21:10 +02:00
vhost vhost-vdpa: switch to use vmf_insert_pfn() in the fault handler 2024-08-14 13:58:55 +02:00
video fbdev: vesafb: Detect VGA compatibility from screen info's VESA attributes 2024-08-11 12:47:16 +02:00
virt drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map() 2024-06-12 11:12:09 +02:00
virtio virtio: delete vq in vp_find_vqs_msix() when request_irq() fails 2024-06-12 11:12:49 +02:00
vlynq bus: Make remove callback return void 2021-07-21 11:53:42 +02:00
w1 nvmem: add explicit config option to read old syntax fixed OF cells 2024-05-17 12:01:55 +02:00
watchdog watchdog: rzg2l_wdt: Check return status of pm_runtime_put() 2024-08-03 08:54:35 +02:00
xen xen: privcmd: Switch from mutex to spinlock for irqfds 2024-08-14 13:58:42 +02:00
zorro zorro: Include zorro.h in names.c 2023-08-21 13:27:44 +02:00
Kconfig Merge patch series "Add non-coherent DMA support for AX45MP" 2023-09-08 11:24:34 -07:00
Makefile pmdomain: Rename the genpd subsystem to pmdomain 2023-09-13 11:09:21 +02:00