> During the closure of a datagram socket, the vmci_transport_recv_dgram_cb()
> function may be called, which will add the packets
> to the socket's backlog; then, after the receive queue is cleared,
> the __release_sock() function will move the packet back from the socket's
> backlog to the receive queue, which will lead to a memory leak.
>
> sock_close
> __sock_release
> __vsock_release
> // take ownership by user-space
> lock_sock_nested
> sock_set_flag(sk, SOCK_DEAD)
> vmci_transport_release
> vmci_dispatch_dgs
> vmci_datagram_invoke_guest_handler
> [ ... ]
> Found by InfoTeCS on behalf of Linux Verification Center
> (linuxtesting.org) with Syzkaller.
>
> Fixes: d021c344051a ("VSOCK: Introduce VM Sockets")
> Signed-off-by: Ilia Gavrilov <[email protected]>
Sashiko has reviewed this patch and found no issues. It looks great!
--
Sashiko AI review ยท
https://sashiko.dev/#/patchset/[email protected]?part=1
