net: xfrm: fix memory leak in xfrm_user_rcv_msg
authorPavel Skripkin <paskripkin@gmail.com>
Fri, 25 Jun 2021 10:23:54 +0000 (13:23 +0300)
committerSteffen Klassert <steffen.klassert@secunet.com>
Tue, 29 Jun 2021 10:16:08 +0000 (12:16 +0200)
commit7c1a80e80cde008f271bae630d28cf684351e807
tree5eb085441dc88a5252c433dcbd78b50ac2ca26aa
parenta118ff661889ecee3ca90f8125bad8fb5bbc07d5
net: xfrm: fix memory leak in xfrm_user_rcv_msg

Syzbot reported memory leak in xfrm_user_rcv_msg(). The
problem was is non-freed skb's frag_list.

In skb_release_all() skb_release_data() will be called only
in case of skb->head != NULL, but netlink_skb_destructor()
sets head to NULL. So, allocated frag_list skb should be
freed manualy, since consume_skb() won't take care of it

Fixes: 5106f4a8acff ("xfrm/compat: Add 32=>64-bit messages translator")
Reported-and-tested-by: syzbot+fb347cf82c73a90efcca@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
net/xfrm/xfrm_user.c