kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-24 19:10:26 +00:00
Code Issues Releases Packages Activity
linux/net/ipv6
History
Christoph Paasch 46d33c878f net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 
[ Upstream commit fa390321ab ]

When tcp_ao_copy_all_matching() fails in tcp_v6_syn_recv_sock() it just
exits the function. This ends up causing a memory-leak:

unreferenced object 0xffff0000281a8200 (size 2496):
  comm "softirq", pid 0, jiffies 4295174684
  hex dump (first 32 bytes):
    7f 00 00 06 7f 00 00 06 00 00 00 00 cb a8 88 13  ................
    0a 00 03 61 00 00 00 00 00 00 00 00 00 00 00 00  ...a............
  backtrace (crc 5ebdbe15):
    kmemleak_alloc+0x44/0xe0
    kmem_cache_alloc_noprof+0x248/0x470
    sk_prot_alloc+0x48/0x120
    sk_clone_lock+0x38/0x3b0
    inet_csk_clone_lock+0x34/0x150
    tcp_create_openreq_child+0x3c/0x4a8
    tcp_v6_syn_recv_sock+0x1c0/0x620
    tcp_check_req+0x588/0x790
    tcp_v6_rcv+0x5d0/0xc18
    ip6_protocol_deliver_rcu+0x2d8/0x4c0
    ip6_input_finish+0x74/0x148
    ip6_input+0x50/0x118
    ip6_sublist_rcv+0x2fc/0x3b0
    ipv6_list_rcv+0x114/0x170
    __netif_receive_skb_list_core+0x16c/0x200
    netif_receive_skb_list_internal+0x1f0/0x2d0

This is because in tcp_v6_syn_recv_sock (and the IPv4 counterpart), when
exiting upon error, inet_csk_prepare_forced_close() and tcp_done() need
to be called. They make sure the newsk will end up being correctly
free'd.

tcp_v4_syn_recv_sock() makes this very clear by having the put_and_exit
label that takes care of things. So, this patch here makes sure
tcp_v4_syn_recv_sock and tcp_v6_syn_recv_sock have similar
error-handling and thus fixes the leak for TCP-AO.

Fixes: 06b22ef295 ("net/tcp: Wire TCP-AO to request sockets")
Signed-off-by: Christoph Paasch <cpaasch@openai.com>
Reviewed-by: Dmitry Safonov <0x7f454c46@gmail.com>
Link: https://patch.msgid.link/20250830-tcpao_leak-v1-1-e5878c2c3173@openai.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2025-09-09 18:58:10 +02:00
..
ila net: Fix checksum update for ILA adj-transport 2025-06-27 11:11:40 +01:00
netfilter netfilter: nf_reject: don't leak dst refcount for loopback packets 2025-08-28 16:31:16 +02:00
addrconf.c ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc(). 2025-08-20 18:30:33 +02:00
addrconf_core.c ipv6: Ensure natural alignment of const ipv6 loopback and router addresses 2024-01-30 12:43:18 +01:00
addrlabel.c ipv6: remove RTNL protection from ip6addrlbl_dump() 2024-04-08 11:01:05 +01:00
af_inet6.c net: inet6: do not leave a dangling sk pointer in inet6_create() 2024-12-14 20:03:48 +01:00
ah6.c net: fill in MODULE_DESCRIPTION()s for ipv6 modules 2024-02-09 14:12:01 -08:00
anycast.c ipv6: anycast: use call_rcu_hurry() in aca_put() 2024-05-01 11:46:21 +01:00
calipso.c calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). 2025-06-27 11:11:44 +01:00
datagram.c ipv6: annotate data-races around np->ucast_oif 2023-12-11 10:59:17 +00:00
esp6.c espintcp: remove encap socket caching to avoid reference leak 2025-05-29 11:03:14 +02:00
esp6_offload.c xfrm: Add an inbound percpu state cache. 2025-02-08 09:58:00 +01:00
exthdrs.c net: ipv6: exthdrs: get rid of ipv6_skb_net() 2024-03-11 15:15:08 -07:00
exthdrs_core.c ipv6: Fix out-of-bounds access in ipv6_find_tlv() 2023-05-24 08:43:39 +01:00
exthdrs_offload.c net: gso: add HBH extension header offload support 2024-01-05 08:11:49 -08:00
fib6_notifier.c net: fib_notifier: propagate extack down to the notifier block callback 2019-10-04 11:10:56 -07:00
fib6_rules.c ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure(). 2025-05-29 11:02:57 +02:00
fou6.c net: Add MODULE_DESCRIPTION entries to network modules 2020-06-20 21:33:57 -07:00
icmp.c ipv6: icmp: convert to dev_net_rcu() 2025-02-21 14:01:42 +01:00
inet6_connection_sock.c net: implement lockless SO_PRIORITY 2023-10-01 19:09:54 +01:00
inet6_hashtables.c inet6: constify 'struct net' parameter of various lookup helpers 2024-08-05 16:27:26 -07:00
ioam6.c ipv6/addrconf: annotate data-races around devconf fields (II) 2024-03-01 08:42:33 +00:00
ioam6_iptunnel.c net: ipv6: ioam6: fix lwtunnel_output() loop 2025-03-28 22:03:28 +01:00
ip6_checksum.c net: udp: fix handling of CHECKSUM_COMPLETE packets 2018-10-24 14:18:16 -07:00
ip6_fib.c ipv6: annotate data-races around rt->fib6_nsiblings 2025-08-15 12:13:48 +02:00
ip6_flowlabel.c ipv6: move np->repflow to atomic flags 2023-09-15 10:33:48 +01:00
ip6_gre.c net: ipv6: Init tunnel link-netns before registering dev 2025-05-29 11:02:40 +02:00
ip6_icmp.c icmp: fix icmp_ndo_send address translation for reply direction 2025-09-09 18:58:08 +02:00
ip6_input.c net/ipv6: make use of the helper macro LIST_HEAD() 2024-09-06 18:10:21 -07:00
ip6_offload.c ipv6: reject malicious packets in ipv6_gso_segment() 2025-08-15 12:14:06 +02:00
ip6_offload.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
ip6_output.c ipv6: remove leftover ip6 cookie initializer 2025-06-27 11:11:41 +01:00
ip6_tunnel.c net: ipv6: Init tunnel link-netns before registering dev 2025-05-29 11:02:40 +02:00
ip6_udp_tunnel.c net: fill in MODULE_DESCRIPTION()s for ipv6 modules 2024-02-09 14:12:01 -08:00
ip6_vti.c net: ipv6: Init tunnel link-netns before registering dev 2025-05-29 11:02:40 +02:00
ip6mr.c net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain 2025-08-15 12:13:39 +02:00
ipcomp6.c xfrm: ipcomp: add extack to ipcomp{4,6}_init_state 2022-09-29 07:18:00 +02:00
ipv6_sockglue.c ipv6: avoid indirect calls for SOL_IP socket options 2024-08-26 14:53:50 -07:00
Kconfig net: ipv6: select DST_CACHE from IPV6_RPL_LWTUNNEL 2024-09-22 19:52:07 +01:00
Makefile net/tcp: Introduce TCP_AO setsockopt()s 2023-10-27 10:35:44 +01:00
mcast.c ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc(). 2025-08-20 18:30:33 +02:00
mcast_snoop.c net: bridge: mcast: fix broken length + header check for MRDv6 Adv. 2021-04-27 14:02:06 -07:00
mip6.c net: fill in MODULE_DESCRIPTION()s for ipv6 modules 2024-02-09 14:12:01 -08:00
ndisc.c ndisc: extend RCU protection in ndisc_send_skb() 2025-02-21 14:01:43 +01:00
netfilter.c netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it 2025-06-19 15:31:46 +02:00
output_core.c ipv6: annotate data-races around cnf.hop_limit 2024-03-01 08:42:31 +00:00
ping.c ipv6: introduce dst_rt6_info() helper 2024-04-29 13:32:01 +01:00
proc.c minmax: add a few more MIN_T/MAX_T users 2024-07-28 13:41:14 -07:00
protocol.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
raw.c ipv6: replace ipcm6_init calls with ipcm6_init_sk 2025-06-27 11:11:41 +01:00
reassembly.c net: Rename mono_delivery_time to tstamp_type for scalabilty 2024-05-23 14:14:23 -07:00
route.c ipv6: annotate data-races around rt->fib6_nsiblings 2025-08-15 12:13:48 +02:00
rpl.c ipv6: rpl: Remove pskb(_may)?_pull() in ipv6_rpl_srh_rcv(). 2023-06-19 11:32:58 -07:00
rpl_iptunnel.c rpl: Fix use-after-free in rpl_do_srh_inline(). 2025-07-24 08:56:30 +02:00
seg6.c ipv6: sr: restruct ifdefines 2024-05-30 18:29:38 -07:00
seg6_hmac.c ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add 2025-08-28 16:31:14 +02:00
seg6_iptunnel.c net: ipv6: fix dst ref loop on input in seg6 lwt 2025-03-07 18:25:33 +01:00
seg6_local.c seg6: Fix validation of nexthop addresses 2025-06-19 15:32:20 +02:00
sit.c net: ipv6: Init tunnel link-netns before registering dev 2025-05-29 11:02:40 +02:00
syncookies.c tcp: use sk_skb_reason_drop to free rx packets 2024-06-19 12:44:22 +01:00
sysctl_net_ipv6.c sysctl: treewide: constify the ctl_table argument of proc_handlers 2024-07-24 20:59:29 +02:00
tcp_ao.c net/tcp: Wire up l3index to TCP-AO 2023-10-27 10:35:46 +01:00
tcp_ipv6.c net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 2025-09-09 18:58:10 +02:00
tcpv6_offload.c net: use sock_gen_put() when sk_state is TCP_TIME_WAIT 2025-05-09 09:50:46 +02:00
tunnel6.c net: fill in MODULE_DESCRIPTION()s for ipv6 modules 2024-02-09 14:12:01 -08:00
udp.c ipv6: replace ipcm6_init calls with ipcm6_init_sk 2025-06-27 11:11:41 +01:00
udp_impl.h tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct(). 2022-10-12 17:50:37 -07:00
udp_offload.c net: gro: fix udp bad offset in socket lookup by adding {inner_}network_offset to napi_gro_cb 2024-05-02 11:02:48 +02:00
udplite.c udplite: remove UDPLITE_BIT 2023-09-14 16:16:36 +02:00
xfrm6_input.c xfrm: Set transport header to fix UDP GRO handling 2025-08-01 09:48:40 +01:00
xfrm6_output.c ipv6: drop feature RTAX_FEATURE_ALLFRAG 2023-10-25 18:04:29 -07:00
xfrm6_policy.c xfrm: respect ip protocols rules criteria when performing dst lookups 2024-09-23 07:02:07 +02:00
xfrm6_protocol.c xfrm: add support for UDPv6 encapsulation of ESP 2020-04-28 11:28:36 +02:00
xfrm6_state.c xfrm: remove output_finish indirection from xfrm_state_afinfo 2020-05-06 09:40:08 +02:00
xfrm6_tunnel.c ipsec-next-2024-03-06 2024-03-08 10:56:05 +00:00