vsock/virtio: free queued packets when closing socket
mainline inclusion from mainline-v5.13-rc1 commit 8432b811 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94J63 CVE: CVE-2021-47024 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8432b8114957235f42e070a16118a7f750de9d39 -------------------------------- As reported by syzbot [1], there is a memory leak while closing the socket. We partially solved this issue with commit ac03046e ("vsock/virtio: free packets during the socket release"), but we forgot to drain the RX queue when the socket is definitely closed by the scheduled work. To avoid future issues, let's use the new virtio_transport_remove_sock() to drain the RX queue before removing the socket from the af_vsock lists calling vsock_remove_sock(). [1] https://syzkaller.appspot.com/bug?extid=24452624fc4c571eedd9 Fixes: ac03046e ("vsock/virtio: free packets during the socket release") Reported-and-tested-by:<syzbot+24452624fc4c571eedd9@syzkaller.appspotmail.com> Signed-off-by:
Stefano Garzarella <sgarzare@redhat.com> Signed-off-by:
David S. Miller <davem@davemloft.net> Conflicts: net/vmw_vsock/virtio_transport_common.c Signed-off-by:
Ziyang Xuan <william.xuanziyang@huawei.com>
Loading
Please sign in to comment