packet: fix leakage of tx_ring memory
authorPhil Sutter <phil.sutter@viprinet.com>
Fri, 1 Feb 2013 07:21:41 +0000 (07:21 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 14 Feb 2013 18:48:18 +0000 (10:48 -0800)
commit29cb024d2df4072cba88d8c7e62cc7617fbb689d
tree6f25d013fb3bd475959b99a81a1c758651690fc3
parentbec1a03d483aa8e50657f2599d228fc879d385ea
packet: fix leakage of tx_ring memory

[ Upstream commit 9665d5d62487e8e7b1f546c00e11107155384b9a ]

When releasing a packet socket, the routine packet_set_ring() is reused
to free rings instead of allocating them. But when calling it for the
first time, it fills req->tp_block_nr with the value of rb->pg_vec_len
which in the second invocation makes it bail out since req->tp_block_nr
is greater zero but req->tp_block_size is zero.

This patch solves the problem by passing a zeroed auto-variable to
packet_set_ring() upon each invocation from packet_release().

As far as I can tell, this issue exists even since 69e3c75 (net: TX_RING
and packet mmap), i.e. the original inclusion of TX ring support into
af_packet, but applies only to sockets with both RX and TX ring
allocated, which is probably why this was unnoticed all the time.

Signed-off-by: Phil Sutter <phil.sutter@viprinet.com>
Cc: Johann Baudy <johann.baudy@gnu-log.net>
Cc: Daniel Borkmann <dborkman@redhat.com>
Acked-by: Daniel Borkmann <dborkman@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/packet/af_packet.c