aboutsummaryrefslogtreecommitdiffstats
path: root/net/packet
diff options
context:
space:
mode:
authorPhil Sutter <phil.sutter@viprinet.com>2013-02-01 07:21:41 +0000
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2013-02-14 10:47:34 -0800
commit069d8ee0271bdf29ac0fc1186cbedb3815f94255 (patch)
tree382f61c4da0eef4dd7f3c86d42a37678613708ce /net/packet
parentd72b29e562214c7c5b635c3f44884a37bd115739 (diff)
downloadkernel_samsung_tuna-069d8ee0271bdf29ac0fc1186cbedb3815f94255.zip
kernel_samsung_tuna-069d8ee0271bdf29ac0fc1186cbedb3815f94255.tar.gz
kernel_samsung_tuna-069d8ee0271bdf29ac0fc1186cbedb3815f94255.tar.bz2
packet: fix leakage of tx_ring memory
[ Upstream commit 9665d5d62487e8e7b1f546c00e11107155384b9a ] When releasing a packet socket, the routine packet_set_ring() is reused to free rings instead of allocating them. But when calling it for the first time, it fills req->tp_block_nr with the value of rb->pg_vec_len which in the second invocation makes it bail out since req->tp_block_nr is greater zero but req->tp_block_size is zero. This patch solves the problem by passing a zeroed auto-variable to packet_set_ring() upon each invocation from packet_release(). As far as I can tell, this issue exists even since 69e3c75 (net: TX_RING and packet mmap), i.e. the original inclusion of TX ring support into af_packet, but applies only to sockets with both RX and TX ring allocated, which is probably why this was unnoticed all the time. Signed-off-by: Phil Sutter <phil.sutter@viprinet.com> Cc: Johann Baudy <johann.baudy@gnu-log.net> Cc: Daniel Borkmann <dborkman@redhat.com> Acked-by: Daniel Borkmann <dborkman@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/packet')
-rw-r--r--net/packet/af_packet.c10
1 files changed, 6 insertions, 4 deletions
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 1ab5a02..4058afe 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1349,13 +1349,15 @@ static int packet_release(struct socket *sock)
packet_flush_mclist(sk);
- memset(&req, 0, sizeof(req));
-
- if (po->rx_ring.pg_vec)
+ if (po->rx_ring.pg_vec) {
+ memset(&req, 0, sizeof(req));
packet_set_ring(sk, &req, 1, 0);
+ }
- if (po->tx_ring.pg_vec)
+ if (po->tx_ring.pg_vec) {
+ memset(&req, 0, sizeof(req));
packet_set_ring(sk, &req, 1, 1);
+ }
synchronize_net();
/*