Drop net-kcm-fix-memory-leak-in-kcm_sendmsg.patch

Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/queue-4.14/net-kcm-fix-memory-leak-in-kcm_sendmsg.patch b/queue-4.14/net-kcm-fix-memory-leak-in-kcm_sendmsg.patch
deleted file mode 100644 (file)
index a18b1cb..0000000
--- a/queue-4.14/net-kcm-fix-memory-leak-in-kcm_sendmsg.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From c47cc304990a2813995b1a92bbc11d0bb9a19ea9 Mon Sep 17 00:00:00 2001
-From: Pavel Skripkin <paskripkin@gmail.com>
-Date: Wed, 2 Jun 2021 22:26:40 +0300
-Subject: net: kcm: fix memory leak in kcm_sendmsg
-
-From: Pavel Skripkin <paskripkin@gmail.com>
-
-commit c47cc304990a2813995b1a92bbc11d0bb9a19ea9 upstream.
-
-Syzbot reported memory leak in kcm_sendmsg()[1].
-The problem was in non-freed frag_list in case of error.
-
-In the while loop:
-
-       if (head == skb)
-               skb_shinfo(head)->frag_list = tskb;
-       else
-               skb->next = tskb;
-
-frag_list filled with skbs, but nothing was freeing them.
-
-backtrace:
-  [<0000000094c02615>] __alloc_skb+0x5e/0x250 net/core/skbuff.c:198
-  [<00000000e5386cbd>] alloc_skb include/linux/skbuff.h:1083 [inline]
-  [<00000000e5386cbd>] kcm_sendmsg+0x3b6/0xa50 net/kcm/kcmsock.c:967 [1]
-  [<00000000f1613a8a>] sock_sendmsg_nosec net/socket.c:652 [inline]
-  [<00000000f1613a8a>] sock_sendmsg+0x4c/0x60 net/socket.c:672
-
-Reported-and-tested-by: syzbot+b039f5699bd82e1fb011@syzkaller.appspotmail.com
-Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module")
-Cc: stable@vger.kernel.org
-Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- net/kcm/kcmsock.c |    5 +++++
- 1 file changed, 5 insertions(+)
-
---- a/net/kcm/kcmsock.c
-+++ b/net/kcm/kcmsock.c
-@@ -1067,6 +1067,11 @@ out_error:
-               goto partial_message;
-       }
- 
-+      if (skb_has_frag_list(head)) {
-+              kfree_skb_list(skb_shinfo(head)->frag_list);
-+              skb_shinfo(head)->frag_list = NULL;
-+      }
-+
-       if (head != kcm->seq_skb)
-               kfree_skb(head);
- 

diff --git a/queue-4.14/series b/queue-4.14/series
index b4d8b365b5465f2e20904e8235e3872f62351399..eff7ce2e064c80430369576c8e7a2e7f32626d57 100644 (file)
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -12,7 +12,6 @@ ieee802154-fix-error-return-code-in-ieee802154_add_i.patch
 ieee802154-fix-error-return-code-in-ieee802154_llsec.patch
 bluetooth-fix-the-erroneous-flush_work-order.patch
 bluetooth-use-correct-lock-to-prevent-uaf-of-hdev-object.patch
-net-kcm-fix-memory-leak-in-kcm_sendmsg.patch
 net-caif-added-cfserl_release-function.patch
 net-caif-add-proper-error-handling.patch
 net-caif-fix-memory-leak-in-caif_device_notify.patch

diff --git a/queue-4.19/net-kcm-fix-memory-leak-in-kcm_sendmsg.patch b/queue-4.19/net-kcm-fix-memory-leak-in-kcm_sendmsg.patch
deleted file mode 100644 (file)
index a18b1cb..0000000
--- a/queue-4.19/net-kcm-fix-memory-leak-in-kcm_sendmsg.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From c47cc304990a2813995b1a92bbc11d0bb9a19ea9 Mon Sep 17 00:00:00 2001
-From: Pavel Skripkin <paskripkin@gmail.com>
-Date: Wed, 2 Jun 2021 22:26:40 +0300
-Subject: net: kcm: fix memory leak in kcm_sendmsg
-
-From: Pavel Skripkin <paskripkin@gmail.com>
-
-commit c47cc304990a2813995b1a92bbc11d0bb9a19ea9 upstream.
-
-Syzbot reported memory leak in kcm_sendmsg()[1].
-The problem was in non-freed frag_list in case of error.
-
-In the while loop:
-
-       if (head == skb)
-               skb_shinfo(head)->frag_list = tskb;
-       else
-               skb->next = tskb;
-
-frag_list filled with skbs, but nothing was freeing them.
-
-backtrace:
-  [<0000000094c02615>] __alloc_skb+0x5e/0x250 net/core/skbuff.c:198
-  [<00000000e5386cbd>] alloc_skb include/linux/skbuff.h:1083 [inline]
-  [<00000000e5386cbd>] kcm_sendmsg+0x3b6/0xa50 net/kcm/kcmsock.c:967 [1]
-  [<00000000f1613a8a>] sock_sendmsg_nosec net/socket.c:652 [inline]
-  [<00000000f1613a8a>] sock_sendmsg+0x4c/0x60 net/socket.c:672
-
-Reported-and-tested-by: syzbot+b039f5699bd82e1fb011@syzkaller.appspotmail.com
-Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module")
-Cc: stable@vger.kernel.org
-Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- net/kcm/kcmsock.c |    5 +++++
- 1 file changed, 5 insertions(+)
-
---- a/net/kcm/kcmsock.c
-+++ b/net/kcm/kcmsock.c
-@@ -1067,6 +1067,11 @@ out_error:
-               goto partial_message;
-       }
- 
-+      if (skb_has_frag_list(head)) {
-+              kfree_skb_list(skb_shinfo(head)->frag_list);
-+              skb_shinfo(head)->frag_list = NULL;
-+      }
-+
-       if (head != kcm->seq_skb)
-               kfree_skb(head);
- 

diff --git a/queue-4.19/series b/queue-4.19/series
index 0090da602a243d19cfa2d9d387595e4f79741883..9817bf1d1b8b6ecdef7cb60109445936b308dcc4 100644 (file)
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -18,7 +18,6 @@ tipc-add-extack-messages-for-bearer-media-failure.patch
 tipc-fix-unique-bearer-names-sanity-check.patch
 bluetooth-fix-the-erroneous-flush_work-order.patch
 bluetooth-use-correct-lock-to-prevent-uaf-of-hdev-object.patch
-net-kcm-fix-memory-leak-in-kcm_sendmsg.patch
 net-caif-added-cfserl_release-function.patch
 net-caif-add-proper-error-handling.patch
 net-caif-fix-memory-leak-in-caif_device_notify.patch

diff --git a/queue-4.9/net-kcm-fix-memory-leak-in-kcm_sendmsg.patch b/queue-4.9/net-kcm-fix-memory-leak-in-kcm_sendmsg.patch
deleted file mode 100644 (file)
index 889d711..0000000
--- a/queue-4.9/net-kcm-fix-memory-leak-in-kcm_sendmsg.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From c47cc304990a2813995b1a92bbc11d0bb9a19ea9 Mon Sep 17 00:00:00 2001
-From: Pavel Skripkin <paskripkin@gmail.com>
-Date: Wed, 2 Jun 2021 22:26:40 +0300
-Subject: net: kcm: fix memory leak in kcm_sendmsg
-
-From: Pavel Skripkin <paskripkin@gmail.com>
-
-commit c47cc304990a2813995b1a92bbc11d0bb9a19ea9 upstream.
-
-Syzbot reported memory leak in kcm_sendmsg()[1].
-The problem was in non-freed frag_list in case of error.
-
-In the while loop:
-
-       if (head == skb)
-               skb_shinfo(head)->frag_list = tskb;
-       else
-               skb->next = tskb;
-
-frag_list filled with skbs, but nothing was freeing them.
-
-backtrace:
-  [<0000000094c02615>] __alloc_skb+0x5e/0x250 net/core/skbuff.c:198
-  [<00000000e5386cbd>] alloc_skb include/linux/skbuff.h:1083 [inline]
-  [<00000000e5386cbd>] kcm_sendmsg+0x3b6/0xa50 net/kcm/kcmsock.c:967 [1]
-  [<00000000f1613a8a>] sock_sendmsg_nosec net/socket.c:652 [inline]
-  [<00000000f1613a8a>] sock_sendmsg+0x4c/0x60 net/socket.c:672
-
-Reported-and-tested-by: syzbot+b039f5699bd82e1fb011@syzkaller.appspotmail.com
-Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module")
-Cc: stable@vger.kernel.org
-Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- net/kcm/kcmsock.c |    5 +++++
- 1 file changed, 5 insertions(+)
-
---- a/net/kcm/kcmsock.c
-+++ b/net/kcm/kcmsock.c
-@@ -1065,6 +1065,11 @@ out_error:
-               goto partial_message;
-       }
- 
-+      if (skb_has_frag_list(head)) {
-+              kfree_skb_list(skb_shinfo(head)->frag_list);
-+              skb_shinfo(head)->frag_list = NULL;
-+      }
-+
-       if (head != kcm->seq_skb)
-               kfree_skb(head);
- 

diff --git a/queue-4.9/series b/queue-4.9/series
index b4d8b365b5465f2e20904e8235e3872f62351399..eff7ce2e064c80430369576c8e7a2e7f32626d57 100644 (file)
--- a/queue-4.9/series
+++ b/queue-4.9/series
@@ -12,7 +12,6 @@ ieee802154-fix-error-return-code-in-ieee802154_add_i.patch
 ieee802154-fix-error-return-code-in-ieee802154_llsec.patch
 bluetooth-fix-the-erroneous-flush_work-order.patch
 bluetooth-use-correct-lock-to-prevent-uaf-of-hdev-object.patch
-net-kcm-fix-memory-leak-in-kcm_sendmsg.patch
 net-caif-added-cfserl_release-function.patch
 net-caif-add-proper-error-handling.patch
 net-caif-fix-memory-leak-in-caif_device_notify.patch

diff --git a/queue-5.10/net-kcm-fix-memory-leak-in-kcm_sendmsg.patch b/queue-5.10/net-kcm-fix-memory-leak-in-kcm_sendmsg.patch
deleted file mode 100644 (file)
index 6913173..0000000
--- a/queue-5.10/net-kcm-fix-memory-leak-in-kcm_sendmsg.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From c47cc304990a2813995b1a92bbc11d0bb9a19ea9 Mon Sep 17 00:00:00 2001
-From: Pavel Skripkin <paskripkin@gmail.com>
-Date: Wed, 2 Jun 2021 22:26:40 +0300
-Subject: net: kcm: fix memory leak in kcm_sendmsg
-
-From: Pavel Skripkin <paskripkin@gmail.com>
-
-commit c47cc304990a2813995b1a92bbc11d0bb9a19ea9 upstream.
-
-Syzbot reported memory leak in kcm_sendmsg()[1].
-The problem was in non-freed frag_list in case of error.
-
-In the while loop:
-
-       if (head == skb)
-               skb_shinfo(head)->frag_list = tskb;
-       else
-               skb->next = tskb;
-
-frag_list filled with skbs, but nothing was freeing them.
-
-backtrace:
-  [<0000000094c02615>] __alloc_skb+0x5e/0x250 net/core/skbuff.c:198
-  [<00000000e5386cbd>] alloc_skb include/linux/skbuff.h:1083 [inline]
-  [<00000000e5386cbd>] kcm_sendmsg+0x3b6/0xa50 net/kcm/kcmsock.c:967 [1]
-  [<00000000f1613a8a>] sock_sendmsg_nosec net/socket.c:652 [inline]
-  [<00000000f1613a8a>] sock_sendmsg+0x4c/0x60 net/socket.c:672
-
-Reported-and-tested-by: syzbot+b039f5699bd82e1fb011@syzkaller.appspotmail.com
-Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module")
-Cc: stable@vger.kernel.org
-Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- net/kcm/kcmsock.c |    5 +++++
- 1 file changed, 5 insertions(+)
-
---- a/net/kcm/kcmsock.c
-+++ b/net/kcm/kcmsock.c
-@@ -1066,6 +1066,11 @@ out_error:
-               goto partial_message;
-       }
- 
-+      if (skb_has_frag_list(head)) {
-+              kfree_skb_list(skb_shinfo(head)->frag_list);
-+              skb_shinfo(head)->frag_list = NULL;
-+      }
-+
-       if (head != kcm->seq_skb)
-               kfree_skb(head);
- 

diff --git a/queue-5.10/series b/queue-5.10/series
index af4e0cb0224ed49a0b3a46479b88fb5d188cfe02..92d13c58c9562b9786d7ea7565310c84c812b31f 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -86,7 +86,6 @@ wireguard-allowedips-initialize-list-head-in-selftest.patch
 wireguard-allowedips-remove-nodes-in-o-1.patch
 wireguard-allowedips-allocate-nodes-in-kmem_cache.patch
 wireguard-allowedips-free-empty-intermediate-nodes-when-removing-single-node.patch
-net-kcm-fix-memory-leak-in-kcm_sendmsg.patch
 net-caif-added-cfserl_release-function.patch
 net-caif-add-proper-error-handling.patch
 net-caif-fix-memory-leak-in-caif_device_notify.patch

diff --git a/queue-5.12/net-kcm-fix-memory-leak-in-kcm_sendmsg.patch b/queue-5.12/net-kcm-fix-memory-leak-in-kcm_sendmsg.patch
deleted file mode 100644 (file)
index 6913173..0000000
--- a/queue-5.12/net-kcm-fix-memory-leak-in-kcm_sendmsg.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From c47cc304990a2813995b1a92bbc11d0bb9a19ea9 Mon Sep 17 00:00:00 2001
-From: Pavel Skripkin <paskripkin@gmail.com>
-Date: Wed, 2 Jun 2021 22:26:40 +0300
-Subject: net: kcm: fix memory leak in kcm_sendmsg
-
-From: Pavel Skripkin <paskripkin@gmail.com>
-
-commit c47cc304990a2813995b1a92bbc11d0bb9a19ea9 upstream.
-
-Syzbot reported memory leak in kcm_sendmsg()[1].
-The problem was in non-freed frag_list in case of error.
-
-In the while loop:
-
-       if (head == skb)
-               skb_shinfo(head)->frag_list = tskb;
-       else
-               skb->next = tskb;
-
-frag_list filled with skbs, but nothing was freeing them.
-
-backtrace:
-  [<0000000094c02615>] __alloc_skb+0x5e/0x250 net/core/skbuff.c:198
-  [<00000000e5386cbd>] alloc_skb include/linux/skbuff.h:1083 [inline]
-  [<00000000e5386cbd>] kcm_sendmsg+0x3b6/0xa50 net/kcm/kcmsock.c:967 [1]
-  [<00000000f1613a8a>] sock_sendmsg_nosec net/socket.c:652 [inline]
-  [<00000000f1613a8a>] sock_sendmsg+0x4c/0x60 net/socket.c:672
-
-Reported-and-tested-by: syzbot+b039f5699bd82e1fb011@syzkaller.appspotmail.com
-Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module")
-Cc: stable@vger.kernel.org
-Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- net/kcm/kcmsock.c |    5 +++++
- 1 file changed, 5 insertions(+)
-
---- a/net/kcm/kcmsock.c
-+++ b/net/kcm/kcmsock.c
-@@ -1066,6 +1066,11 @@ out_error:
-               goto partial_message;
-       }
- 
-+      if (skb_has_frag_list(head)) {
-+              kfree_skb_list(skb_shinfo(head)->frag_list);
-+              skb_shinfo(head)->frag_list = NULL;
-+      }
-+
-       if (head != kcm->seq_skb)
-               kfree_skb(head);
- 

diff --git a/queue-5.12/series b/queue-5.12/series
index 71e6166eaa865bd9449138ed1550f884ba04c704..267fe1f7b91d6d28fce5a56e488056b2cbcdc395 100644 (file)
--- a/queue-5.12/series
+++ b/queue-5.12/series
@@ -100,7 +100,6 @@ wireguard-allowedips-initialize-list-head-in-selftest.patch
 wireguard-allowedips-remove-nodes-in-o-1.patch
 wireguard-allowedips-allocate-nodes-in-kmem_cache.patch
 wireguard-allowedips-free-empty-intermediate-nodes-when-removing-single-node.patch
-net-kcm-fix-memory-leak-in-kcm_sendmsg.patch
 net-caif-added-cfserl_release-function.patch
 net-caif-add-proper-error-handling.patch
 net-caif-fix-memory-leak-in-caif_device_notify.patch

diff --git a/queue-5.4/net-kcm-fix-memory-leak-in-kcm_sendmsg.patch b/queue-5.4/net-kcm-fix-memory-leak-in-kcm_sendmsg.patch
deleted file mode 100644 (file)
index da2decb..0000000
--- a/queue-5.4/net-kcm-fix-memory-leak-in-kcm_sendmsg.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From c47cc304990a2813995b1a92bbc11d0bb9a19ea9 Mon Sep 17 00:00:00 2001
-From: Pavel Skripkin <paskripkin@gmail.com>
-Date: Wed, 2 Jun 2021 22:26:40 +0300
-Subject: net: kcm: fix memory leak in kcm_sendmsg
-
-From: Pavel Skripkin <paskripkin@gmail.com>
-
-commit c47cc304990a2813995b1a92bbc11d0bb9a19ea9 upstream.
-
-Syzbot reported memory leak in kcm_sendmsg()[1].
-The problem was in non-freed frag_list in case of error.
-
-In the while loop:
-
-       if (head == skb)
-               skb_shinfo(head)->frag_list = tskb;
-       else
-               skb->next = tskb;
-
-frag_list filled with skbs, but nothing was freeing them.
-
-backtrace:
-  [<0000000094c02615>] __alloc_skb+0x5e/0x250 net/core/skbuff.c:198
-  [<00000000e5386cbd>] alloc_skb include/linux/skbuff.h:1083 [inline]
-  [<00000000e5386cbd>] kcm_sendmsg+0x3b6/0xa50 net/kcm/kcmsock.c:967 [1]
-  [<00000000f1613a8a>] sock_sendmsg_nosec net/socket.c:652 [inline]
-  [<00000000f1613a8a>] sock_sendmsg+0x4c/0x60 net/socket.c:672
-
-Reported-and-tested-by: syzbot+b039f5699bd82e1fb011@syzkaller.appspotmail.com
-Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module")
-Cc: stable@vger.kernel.org
-Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- net/kcm/kcmsock.c |    5 +++++
- 1 file changed, 5 insertions(+)
-
---- a/net/kcm/kcmsock.c
-+++ b/net/kcm/kcmsock.c
-@@ -1068,6 +1068,11 @@ out_error:
-               goto partial_message;
-       }
- 
-+      if (skb_has_frag_list(head)) {
-+              kfree_skb_list(skb_shinfo(head)->frag_list);
-+              skb_shinfo(head)->frag_list = NULL;
-+      }
-+
-       if (head != kcm->seq_skb)
-               kfree_skb(head);
- 

diff --git a/queue-5.4/series b/queue-5.4/series
index fcf0db726656b8ce29345f9daec9e87334c0fb46..b3c51707b574d661bbe6562457d7e0356981f2f8 100644 (file)
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -37,7 +37,6 @@ tipc-add-extack-messages-for-bearer-media-failure.patch
 tipc-fix-unique-bearer-names-sanity-check.patch
 bluetooth-fix-the-erroneous-flush_work-order.patch
 bluetooth-use-correct-lock-to-prevent-uaf-of-hdev-object.patch
-net-kcm-fix-memory-leak-in-kcm_sendmsg.patch
 net-caif-added-cfserl_release-function.patch
 net-caif-add-proper-error-handling.patch
 net-caif-fix-memory-leak-in-caif_device_notify.patch