)]}'
{
  "commit": "4862ec7967604e7b67de53b60051546528be76ee",
  "tree": "b6ae7b16f511fdd3718ae703907548f3d29f1940",
  "parents": [
    "659beaabf1b059e571ad521eda1f180dbbc40112"
  ],
  "author": {
    "name": "Kuniyuki Iwashima",
    "email": "kuniyu@amazon.com",
    "time": "Thu Oct 06 11:53:45 2022 -0700"
  },
  "committer": {
    "name": "COS Cherry Picker",
    "email": "cloud-image-release@prod.google.com",
    "time": "Wed Oct 26 22:34:20 2022 -0700"
  },
  "message": "tcp/udp: Fix memory leak in ipv6_renew_options().\n\n[ Upstream commit 3c52c6bb831f6335c176a0fc7214e26f43adbd11 ]\n\nsyzbot reported a memory leak [0] related to IPV6_ADDRFORM.\n\nThe scenario is that while one thread is converting an IPv6 socket into\nIPv4 with IPV6_ADDRFORM, another thread calls do_ipv6_setsockopt() and\nallocates memory to inet6_sk(sk)-\u003eXXX after conversion.\n\nThen, the converted sk with (tcp|udp)_prot never frees the IPv6 resources,\nwhich inet6_destroy_sock() should have cleaned up.\n\nsetsockopt(IPV6_ADDRFORM)                 setsockopt(IPV6_DSTOPTS)\n+-----------------------+                 +----------------------+\n- do_ipv6_setsockopt(sk, ...)\n  - sockopt_lock_sock(sk)                 - do_ipv6_setsockopt(sk, ...)\n    - lock_sock(sk)                         ^._ called via tcpv6_prot\n  - WRITE_ONCE(sk-\u003esk_prot, \u0026tcp_prot)          before WRITE_ONCE()\n  - xchg(\u0026np-\u003eopt, NULL)\n  - txopt_put(opt)\n  - sockopt_release_sock(sk)\n    - release_sock(sk)                      - sockopt_lock_sock(sk)\n                                              - lock_sock(sk)\n                                            - ipv6_set_opt_hdr(sk, ...)\n                                              - ipv6_update_options(sk, opt)\n                                                - xchg(\u0026inet6_sk(sk)-\u003eopt, opt)\n                                                  ^._ opt is never freed.\n\n                                            - sockopt_release_sock(sk)\n                                              - release_sock(sk)\n\nSince IPV6_DSTOPTS allocates options under lock_sock(), we can avoid this\nmemory leak by testing whether sk_family is changed by IPV6_ADDRFORM after\nacquiring the lock.\n\nThis issue exists from the initial commit between IPV6_ADDRFORM and\nIPV6_PKTOPTIONS.\n\n[0]:\nBUG: memory leak\nunreferenced object 0xffff888009ab9f80 (size 96):\n  comm \"syz-executor583\", pid 328, jiffies 4294916198 (age 13.034s)\n  hex dump (first 32 bytes):\n    01 00 00 00 48 00 00 00 08 00 00 00 00 00 00 00  ....H...........\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace:\n    [\u003c000000002ee98ae1\u003e] kmalloc include/linux/slab.h:605 [inline]\n    [\u003c000000002ee98ae1\u003e] sock_kmalloc+0xb3/0x100 net/core/sock.c:2566\n    [\u003c0000000065d7b698\u003e] ipv6_renew_options+0x21e/0x10b0 net/ipv6/exthdrs.c:1318\n    [\u003c00000000a8c756d7\u003e] ipv6_set_opt_hdr net/ipv6/ipv6_sockglue.c:354 [inline]\n    [\u003c00000000a8c756d7\u003e] do_ipv6_setsockopt.constprop.0+0x28b7/0x4350 net/ipv6/ipv6_sockglue.c:668\n    [\u003c000000002854d204\u003e] ipv6_setsockopt+0xdf/0x190 net/ipv6/ipv6_sockglue.c:1021\n    [\u003c00000000e69fdcf8\u003e] tcp_setsockopt+0x13b/0x2620 net/ipv4/tcp.c:3789\n    [\u003c0000000090da4b9b\u003e] __sys_setsockopt+0x239/0x620 net/socket.c:2252\n    [\u003c00000000b10d192f\u003e] __do_sys_setsockopt net/socket.c:2263 [inline]\n    [\u003c00000000b10d192f\u003e] __se_sys_setsockopt net/socket.c:2260 [inline]\n    [\u003c00000000b10d192f\u003e] __x64_sys_setsockopt+0xbe/0x160 net/socket.c:2260\n    [\u003c000000000a80d7aa\u003e] do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n    [\u003c000000000a80d7aa\u003e] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80\n    [\u003c000000004562b5c6\u003e] entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nBUG\u003db/254442564\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixes CVE-2022-3524 in the Linux kernel.\nSOURCE\u003dUPSTREAM(3c52c6bb831f)\n\ncos-patch: security-high\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nReported-by: syzbot \u003csyzkaller@googlegroups.com\u003e\nChange-Id: I7c9db60d02444ebd7db77369a3f0d0c98fd0e569\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@amazon.com\u003e\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/37949\nReviewed-by: Oleksandr Tymoshenko \u003covt@google.com\u003e\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nMain-Branch-Verified: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "5352c7e68c42c3edebf7c037261d1cdf3e86167a",
      "old_mode": 33188,
      "old_path": "net/ipv6/ipv6_sockglue.c",
      "new_id": "1d7fad8269e60dde037ce9a57aabbd4e6a7ee476",
      "new_mode": 33188,
      "new_path": "net/ipv6/ipv6_sockglue.c"
    }
  ]
}