Eric Dumazet 2aab4b9690 af_unix: fix struct pid leaks in OOB support ... syzbot reported struct pid leak [1]. Issue is that queue_oob() calls maybe_add_creds() which potentially holds a reference on a pid. But skb->destructor is not set (either directly or by calling unix_scm_to_skb()) This means that subsequent kfree_skb() or consume_skb() would leak this reference. In this fix, I chose to fully support scm even for the OOB message. [1] BUG: memory leak unreferenced object 0xffff8881053e7f80 (size 128): comm "syz-executor242", pid 5066, jiffies 4294946079 (age 13.220s) hex dump (first 32 bytes): 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff812ae26a>] alloc_pid+0x6a/0x560 kernel/pid.c:180 [<ffffffff812718df>] copy_process+0x169f/0x26c0 kernel/fork.c:2285 [<ffffffff81272b37>] kernel_clone+0xf7/0x610 kernel/fork.c:2684 [<ffffffff812730cc>] __do_sys_clone+0x7c/0xb0 kernel/fork.c:2825 [<ffffffff849ad699>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [<ffffffff849ad699>] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 [<ffffffff84a0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd Fixes: 314001f0bf ("af_unix: Add OOB support") Reported-by: syzbot+7699d9e5635c10253a27@syzkaller.appspotmail.com Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Rao Shoaib <rao.shoaib@oracle.com> Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com> Link: https://lore.kernel.org/r/20230307164530.771896-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2023-03-08 23:26:03 -08:00
..
6lowpan
9p	xen: branch for v6.2-rc4	2023-01-12 17:02:20 -06:00
802	treewide: Convert del_timer*() to timer_shutdown*()	2022-12-25 13:38:09 -08:00
8021q
appletalk
atm	driver core: make struct class.dev_uevent() take a const *	2022-11-24 17:12:15 +01:00
ax25
batman-adv	batman-adv: tvlv: prepare for tvlv enabled multicast packet type	2023-01-21 19:01:59 +01:00
bluetooth	TTY/Serial driver updates for 6.3-rc1	2023-02-24 12:17:14 -08:00
bpf	bpf, test_run: fix &xdp_frame misplacement for LIVE_FRAMES	2023-03-06 11:15:54 -08:00
bpfilter
bridge	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf	2023-02-22 21:25:23 -08:00
caif	net: caif: Fix use-after-free in cfusbl_device_notify()	2023-03-02 22:22:07 -08:00
can	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2023-02-09 12:25:40 -08:00
ceph	Networking changes for 6.3.	2023-02-21 18:24:12 -08:00
core	ynl: re-license uniformly under GPL-2.0 OR BSD-3-Clause	2023-03-07 13:44:30 -08:00
dcb	net: dcb: add helper functions to retrieve PCP and DSCP rewrite maps	2023-01-20 09:33:22 +00:00
dccp	dccp/tcp: Avoid negative sk_forward_alloc by ipv6_pinfo.pktoptions.	2023-02-10 19:53:42 -08:00
devlink	devlink: drop leftover duplicate/unused code	2023-02-20 11:38:35 +00:00
dns_resolver
dsa	net: dsa: use NL_SET_ERR_MSG_WEAK_MOD() more consistently	2023-02-03 19:23:32 -08:00
ethernet	net: ethernet: use sysfs_emit() to instead of scnprintf()	2022-12-07 20:02:44 -08:00
ethtool	net: ethtool: fix __ethtool_dev_mm_supported() implementation	2023-02-21 09:05:01 -08:00
hsr	hsr: Use a single struct for self_node.	2022-12-01 20:26:22 -08:00
ieee802154	ieee802154: Prevent user from crashing the host	2023-03-02 14:39:48 +01:00
ife
ipv4	ynl: re-license uniformly under GPL-2.0 OR BSD-3-Clause	2023-03-07 13:44:30 -08:00
ipv6	netfilter: tproxy: fix deadlock due to missing BH disable	2023-03-06 12:09:48 +01:00
iucv
kcm	net/sock: Introduce trace_sk_data_ready()	2023-01-23 11:26:50 +00:00
key	af_key: Fix heap information leak	2023-02-13 09:30:14 +00:00
l2tp	l2tp: Avoid possible recursive deadlock in l2tp_tunnel_register()	2023-02-20 09:25:20 +00:00
l3mdev
lapb
llc
mac80211	wifi: mac80211: add documentation for amsdu_mesh_control	2023-02-15 18:31:16 +01:00
mac802154	Merge tag 'ieee802154-for-net-next-2023-02-20' of git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan-next	2023-02-20 16:40:52 -08:00
mctp	net: mctp: purge receive queues on sk destruction	2023-01-28 00:26:09 -08:00
mpls	net: mpls: fix stale pointer if allocation fails during device rename	2023-02-15 10:26:37 +00:00
mptcp	net: no longer support SOCK_REFCNT_DEBUG feature	2023-02-15 10:25:21 +00:00
ncsi	net/ncsi: Silence runtime memcpy() false positive warning	2022-12-06 17:29:14 -08:00
netfilter	netfilter: conntrack: adopt safer max chain length	2023-03-07 10:58:06 +01:00
netlabel
netlink	genetlink: Use string_is_terminated() helper	2023-02-09 22:30:24 -08:00
netrom	netrom: Fix use-after-free caused by accept on already connected socket	2023-01-30 07:30:47 +00:00
nfc	nfc: change order inside nfc_se_io error path	2023-03-07 13:37:05 -08:00
nsh
openvswitch	There is no particular theme here - mainly quick hits all over the tree.	2023-02-23 17:55:40 -08:00
packet	net: no longer support SOCK_REFCNT_DEBUG feature	2023-02-15 10:25:21 +00:00
phonet	net/sock: Introduce trace_sk_data_ready()	2023-01-23 11:26:50 +00:00
psample
qrtr	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2023-02-02 14:49:55 -08:00
rds	rds: rds_rm_zerocopy_callback() correct order for list_add_tail()	2023-02-13 09:33:39 +00:00
rfkill	rfkill: Use sysfs_emit() to instead of sprintf()	2023-02-14 12:21:14 +01:00
rose	net/rose: Fix to not accept on connected socket	2023-01-28 00:19:57 -08:00
rxrpc	Networking changes for 6.3.	2023-02-21 18:24:12 -08:00
sched	net/sched: flower: fix fl_change() error recovery path	2023-03-01 08:49:54 +00:00
sctp	sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop	2023-02-23 12:59:40 -08:00
smc	net/smc: fix fallback failed while sendmsg with fastopen	2023-03-08 13:00:55 +00:00
strparser
sunrpc	NFS Client Updates for Linux 6.3	2023-02-22 14:47:20 -08:00
switchdev
tipc	Networking changes for 6.3.	2023-02-21 18:24:12 -08:00
tls	net: tls: fix device-offloaded sendpage straddling records	2023-03-06 13:26:16 -08:00
unix	af_unix: fix struct pid leaks in OOB support	2023-03-08 23:26:03 -08:00
vmw_vsock	Networking changes for 6.3.	2023-02-21 18:24:12 -08:00
wireless	wifi: wext: warn about usage only once	2023-02-26 19:53:35 +02:00
x25	net/x25: Fix to not accept on connected socket	2023-01-25 09:51:04 +00:00
xdp	xsk: add linux/vmalloc.h to xsk.c	2023-02-21 09:00:09 -08:00
xfrm	bpf-next-for-netdev	2023-02-10 17:51:27 -08:00
compat.c	use less confusing names for iov_iter direction initializers	2022-11-25 13:01:55 -05:00
devres.c
Kconfig
Kconfig.debug
Makefile	devlink: move code to a dedicated directory	2023-01-05 22:12:00 -08:00
socket.c	Networking changes for 6.3.	2023-02-21 18:24:12 -08:00
sysctl_net.c