mirror of
				https://github.com/torvalds/linux.git
				synced 2025-11-04 02:30:34 +02:00 
			
		
		
		
	If qrtr_endpoint_register() failed, tun is leaked.
Fix this, by freeing tun in error path.
syzbot report:
BUG: memory leak
unreferenced object 0xffff88811848d680 (size 64):
  comm "syz-executor684", pid 10171, jiffies 4294951561 (age 26.070s)
  hex dump (first 32 bytes):
    80 dd 0a 84 ff ff ff ff 00 00 00 00 00 00 00 00  ................
    90 d6 48 18 81 88 ff ff 90 d6 48 18 81 88 ff ff  ..H.......H.....
  backtrace:
    [<0000000018992a50>] kmalloc include/linux/slab.h:552 [inline]
    [<0000000018992a50>] kzalloc include/linux/slab.h:682 [inline]
    [<0000000018992a50>] qrtr_tun_open+0x22/0x90 net/qrtr/tun.c:35
    [<0000000003a453ef>] misc_open+0x19c/0x1e0 drivers/char/misc.c:141
    [<00000000dec38ac8>] chrdev_open+0x10d/0x340 fs/char_dev.c:414
    [<0000000079094996>] do_dentry_open+0x1e6/0x620 fs/open.c:817
    [<000000004096d290>] do_open fs/namei.c:3252 [inline]
    [<000000004096d290>] path_openat+0x74a/0x1b00 fs/namei.c:3369
    [<00000000b8e64241>] do_filp_open+0xa0/0x190 fs/namei.c:3396
    [<00000000a3299422>] do_sys_openat2+0xed/0x230 fs/open.c:1172
    [<000000002c1bdcef>] do_sys_open fs/open.c:1188 [inline]
    [<000000002c1bdcef>] __do_sys_openat fs/open.c:1204 [inline]
    [<000000002c1bdcef>] __se_sys_openat fs/open.c:1199 [inline]
    [<000000002c1bdcef>] __x64_sys_openat+0x7f/0xe0 fs/open.c:1199
    [<00000000f3a5728f>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
    [<000000004b38b7ec>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
Fixes: 28fb4e59a4 ("net: qrtr: Expose tunneling endpoint to user space")
Reported-by: syzbot+5d6e4af21385f5cfc56a@syzkaller.appspotmail.com
Signed-off-by: Takeshi Misawa <jeliantsurux@gmail.com>
Link: https://lore.kernel.org/r/20210221234427.GA2140@DESKTOP
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
		
	
			
		
			
				
	
	
		
			176 lines
		
	
	
	
		
			3.4 KiB
		
	
	
	
		
			C
		
	
	
	
	
	
			
		
		
	
	
			176 lines
		
	
	
	
		
			3.4 KiB
		
	
	
	
		
			C
		
	
	
	
	
	
// SPDX-License-Identifier: GPL-2.0
 | 
						|
/* Copyright (c) 2018, Linaro Ltd */
 | 
						|
 | 
						|
#include <linux/miscdevice.h>
 | 
						|
#include <linux/module.h>
 | 
						|
#include <linux/poll.h>
 | 
						|
#include <linux/skbuff.h>
 | 
						|
#include <linux/uaccess.h>
 | 
						|
 | 
						|
#include "qrtr.h"
 | 
						|
 | 
						|
struct qrtr_tun {
 | 
						|
	struct qrtr_endpoint ep;
 | 
						|
 | 
						|
	struct sk_buff_head queue;
 | 
						|
	wait_queue_head_t readq;
 | 
						|
};
 | 
						|
 | 
						|
static int qrtr_tun_send(struct qrtr_endpoint *ep, struct sk_buff *skb)
 | 
						|
{
 | 
						|
	struct qrtr_tun *tun = container_of(ep, struct qrtr_tun, ep);
 | 
						|
 | 
						|
	skb_queue_tail(&tun->queue, skb);
 | 
						|
 | 
						|
	/* wake up any blocking processes, waiting for new data */
 | 
						|
	wake_up_interruptible(&tun->readq);
 | 
						|
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
 | 
						|
static int qrtr_tun_open(struct inode *inode, struct file *filp)
 | 
						|
{
 | 
						|
	struct qrtr_tun *tun;
 | 
						|
	int ret;
 | 
						|
 | 
						|
	tun = kzalloc(sizeof(*tun), GFP_KERNEL);
 | 
						|
	if (!tun)
 | 
						|
		return -ENOMEM;
 | 
						|
 | 
						|
	skb_queue_head_init(&tun->queue);
 | 
						|
	init_waitqueue_head(&tun->readq);
 | 
						|
 | 
						|
	tun->ep.xmit = qrtr_tun_send;
 | 
						|
 | 
						|
	filp->private_data = tun;
 | 
						|
 | 
						|
	ret = qrtr_endpoint_register(&tun->ep, QRTR_EP_NID_AUTO);
 | 
						|
	if (ret)
 | 
						|
		goto out;
 | 
						|
 | 
						|
	return 0;
 | 
						|
 | 
						|
out:
 | 
						|
	filp->private_data = NULL;
 | 
						|
	kfree(tun);
 | 
						|
	return ret;
 | 
						|
}
 | 
						|
 | 
						|
static ssize_t qrtr_tun_read_iter(struct kiocb *iocb, struct iov_iter *to)
 | 
						|
{
 | 
						|
	struct file *filp = iocb->ki_filp;
 | 
						|
	struct qrtr_tun *tun = filp->private_data;
 | 
						|
	struct sk_buff *skb;
 | 
						|
	int count;
 | 
						|
 | 
						|
	while (!(skb = skb_dequeue(&tun->queue))) {
 | 
						|
		if (filp->f_flags & O_NONBLOCK)
 | 
						|
			return -EAGAIN;
 | 
						|
 | 
						|
		/* Wait until we get data or the endpoint goes away */
 | 
						|
		if (wait_event_interruptible(tun->readq,
 | 
						|
					     !skb_queue_empty(&tun->queue)))
 | 
						|
			return -ERESTARTSYS;
 | 
						|
	}
 | 
						|
 | 
						|
	count = min_t(size_t, iov_iter_count(to), skb->len);
 | 
						|
	if (copy_to_iter(skb->data, count, to) != count)
 | 
						|
		count = -EFAULT;
 | 
						|
 | 
						|
	kfree_skb(skb);
 | 
						|
 | 
						|
	return count;
 | 
						|
}
 | 
						|
 | 
						|
static ssize_t qrtr_tun_write_iter(struct kiocb *iocb, struct iov_iter *from)
 | 
						|
{
 | 
						|
	struct file *filp = iocb->ki_filp;
 | 
						|
	struct qrtr_tun *tun = filp->private_data;
 | 
						|
	size_t len = iov_iter_count(from);
 | 
						|
	ssize_t ret;
 | 
						|
	void *kbuf;
 | 
						|
 | 
						|
	if (!len)
 | 
						|
		return -EINVAL;
 | 
						|
 | 
						|
	if (len > KMALLOC_MAX_SIZE)
 | 
						|
		return -ENOMEM;
 | 
						|
 | 
						|
	kbuf = kzalloc(len, GFP_KERNEL);
 | 
						|
	if (!kbuf)
 | 
						|
		return -ENOMEM;
 | 
						|
 | 
						|
	if (!copy_from_iter_full(kbuf, len, from)) {
 | 
						|
		kfree(kbuf);
 | 
						|
		return -EFAULT;
 | 
						|
	}
 | 
						|
 | 
						|
	ret = qrtr_endpoint_post(&tun->ep, kbuf, len);
 | 
						|
 | 
						|
	kfree(kbuf);
 | 
						|
	return ret < 0 ? ret : len;
 | 
						|
}
 | 
						|
 | 
						|
static __poll_t qrtr_tun_poll(struct file *filp, poll_table *wait)
 | 
						|
{
 | 
						|
	struct qrtr_tun *tun = filp->private_data;
 | 
						|
	__poll_t mask = 0;
 | 
						|
 | 
						|
	poll_wait(filp, &tun->readq, wait);
 | 
						|
 | 
						|
	if (!skb_queue_empty(&tun->queue))
 | 
						|
		mask |= EPOLLIN | EPOLLRDNORM;
 | 
						|
 | 
						|
	return mask;
 | 
						|
}
 | 
						|
 | 
						|
static int qrtr_tun_release(struct inode *inode, struct file *filp)
 | 
						|
{
 | 
						|
	struct qrtr_tun *tun = filp->private_data;
 | 
						|
 | 
						|
	qrtr_endpoint_unregister(&tun->ep);
 | 
						|
 | 
						|
	/* Discard all SKBs */
 | 
						|
	skb_queue_purge(&tun->queue);
 | 
						|
 | 
						|
	kfree(tun);
 | 
						|
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
 | 
						|
static const struct file_operations qrtr_tun_ops = {
 | 
						|
	.owner = THIS_MODULE,
 | 
						|
	.open = qrtr_tun_open,
 | 
						|
	.poll = qrtr_tun_poll,
 | 
						|
	.read_iter = qrtr_tun_read_iter,
 | 
						|
	.write_iter = qrtr_tun_write_iter,
 | 
						|
	.release = qrtr_tun_release,
 | 
						|
};
 | 
						|
 | 
						|
static struct miscdevice qrtr_tun_miscdev = {
 | 
						|
	MISC_DYNAMIC_MINOR,
 | 
						|
	"qrtr-tun",
 | 
						|
	&qrtr_tun_ops,
 | 
						|
};
 | 
						|
 | 
						|
static int __init qrtr_tun_init(void)
 | 
						|
{
 | 
						|
	int ret;
 | 
						|
 | 
						|
	ret = misc_register(&qrtr_tun_miscdev);
 | 
						|
	if (ret)
 | 
						|
		pr_err("failed to register Qualcomm IPC Router tun device\n");
 | 
						|
 | 
						|
	return ret;
 | 
						|
}
 | 
						|
 | 
						|
static void __exit qrtr_tun_exit(void)
 | 
						|
{
 | 
						|
	misc_deregister(&qrtr_tun_miscdev);
 | 
						|
}
 | 
						|
 | 
						|
module_init(qrtr_tun_init);
 | 
						|
module_exit(qrtr_tun_exit);
 | 
						|
 | 
						|
MODULE_DESCRIPTION("Qualcomm IPC Router TUN device");
 | 
						|
MODULE_LICENSE("GPL v2");
 |