a7555681e5
[ Upstream commit 9ed7bfc79542119ac0a9e1ce8a2a5285e43433e9 ]
When sctp_stream_outq_migrate() is called to release stream out resources,
the memory pointed to by prio_head in stream out is not released.
The memory leak information is as follows:
unreferenced object 0xffff88801fe79f80 (size 64):
comm "sctp_repo", pid 7957, jiffies 4294951704 (age 36.480s)
hex dump (first 32 bytes):
80 9f e7 1f 80 88 ff ff 80 9f e7 1f 80 88 ff ff ................
90 9f e7 1f 80 88 ff ff 90 9f e7 1f 80 88 ff ff ................
backtrace:
[<ffffffff81b215c6>] kmalloc_trace+0x26/0x60
[<ffffffff88ae517c>] sctp_sched_prio_set+0x4cc/0x770
[<ffffffff88ad64f2>] sctp_stream_init_ext+0xd2/0x1b0
[<ffffffff88aa2604>] sctp_sendmsg_to_asoc+0x1614/0x1a30
[<ffffffff88ab7ff1>] sctp_sendmsg+0xda1/0x1ef0
[<ffffffff87f765ed>] inet_sendmsg+0x9d/0xe0
[<ffffffff8754b5b3>] sock_sendmsg+0xd3/0x120
[<ffffffff8755446a>] __sys_sendto+0x23a/0x340
[<ffffffff87554651>] __x64_sys_sendto+0xe1/0x1b0
[<ffffffff89978b49>] do_syscall_64+0x39/0xb0
[<ffffffff89a0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
Link: https://syzkaller.appspot.com/bug?exrid=29c402e56c4760763cc0
Fixes: 637784ade2 ("sctp: introduce priority based stream scheduler")
Reported-by: syzbot+29c402e56c4760763cc0@syzkaller.appspotmail.com
Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
Reviewed-by: Xin Long <lucien.xin@gmail.com>
Link: https://lore.kernel.org/r/20221126031720.378562-1-shaozhengchao@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
65 lines
2.3 KiB
C
65 lines
2.3 KiB
C
/* SPDX-License-Identifier: GPL-2.0-or-later */
|
|
/* SCTP kernel implementation
|
|
* (C) Copyright Red Hat Inc. 2017
|
|
*
|
|
* These are definitions used by the stream schedulers, defined in RFC
|
|
* draft ndata (https://tools.ietf.org/html/draft-ietf-tsvwg-sctp-ndata-11)
|
|
*
|
|
* Please send any bug reports or fixes you make to the
|
|
* email addresses:
|
|
* lksctp developers <linux-sctp@vger.kernel.org>
|
|
*
|
|
* Written or modified by:
|
|
* Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
|
|
*/
|
|
|
|
#ifndef __sctp_stream_sched_h__
|
|
#define __sctp_stream_sched_h__
|
|
|
|
struct sctp_sched_ops {
|
|
/* Property handling for a given stream */
|
|
int (*set)(struct sctp_stream *stream, __u16 sid, __u16 value,
|
|
gfp_t gfp);
|
|
int (*get)(struct sctp_stream *stream, __u16 sid, __u16 *value);
|
|
|
|
/* Init the specific scheduler */
|
|
int (*init)(struct sctp_stream *stream);
|
|
/* Init a stream */
|
|
int (*init_sid)(struct sctp_stream *stream, __u16 sid, gfp_t gfp);
|
|
/* free a stream */
|
|
void (*free_sid)(struct sctp_stream *stream, __u16 sid);
|
|
/* Frees the entire thing */
|
|
void (*free)(struct sctp_stream *stream);
|
|
|
|
/* Enqueue a chunk */
|
|
void (*enqueue)(struct sctp_outq *q, struct sctp_datamsg *msg);
|
|
/* Dequeue a chunk */
|
|
struct sctp_chunk *(*dequeue)(struct sctp_outq *q);
|
|
/* Called only if the chunk fit the packet */
|
|
void (*dequeue_done)(struct sctp_outq *q, struct sctp_chunk *chunk);
|
|
/* Sched all chunks already enqueued */
|
|
void (*sched_all)(struct sctp_stream *steam);
|
|
/* Unched all chunks already enqueued */
|
|
void (*unsched_all)(struct sctp_stream *steam);
|
|
};
|
|
|
|
int sctp_sched_set_sched(struct sctp_association *asoc,
|
|
enum sctp_sched_type sched);
|
|
int sctp_sched_get_sched(struct sctp_association *asoc);
|
|
int sctp_sched_set_value(struct sctp_association *asoc, __u16 sid,
|
|
__u16 value, gfp_t gfp);
|
|
int sctp_sched_get_value(struct sctp_association *asoc, __u16 sid,
|
|
__u16 *value);
|
|
void sctp_sched_dequeue_done(struct sctp_outq *q, struct sctp_chunk *ch);
|
|
|
|
void sctp_sched_dequeue_common(struct sctp_outq *q, struct sctp_chunk *ch);
|
|
int sctp_sched_init_sid(struct sctp_stream *stream, __u16 sid, gfp_t gfp);
|
|
struct sctp_sched_ops *sctp_sched_ops_from_stream(struct sctp_stream *stream);
|
|
|
|
void sctp_sched_ops_register(enum sctp_sched_type sched,
|
|
struct sctp_sched_ops *sched_ops);
|
|
void sctp_sched_ops_prio_init(void);
|
|
void sctp_sched_ops_rr_init(void);
|
|
|
|
#endif /* __sctp_stream_sched_h__ */
|