1. 漏洞描述

In the Linux kernel, the following vulnerability has been resolved:

net: ipv4: fix memory leak in ip_mc_add1_src

BUG: memory leak
unreferenced object 0xffff888101bc4c00 (size 32):
comm "syz-executor527", pid 360, jiffies 4294807421 (age 19.329s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
01 00 00 00 00 00 00 00 ac 14 14 bb 00 00 02 00 ................
backtrace:
[<00000000f17c5244&gt;] kmalloc include/linux/slab.h:558 [inline]
[<00000000f17c5244&gt;] kzalloc include/linux/slab.h:688 [inline]
[<00000000f17c5244&gt;] ip_mc_add1_src net/ipv4/igmp.c:1971 [inline]
[<00000000f17c5244&gt;] ip_mc_add_src+0x95f/0xdb0 net/ipv4/igmp.c:2095
[<000000001cb99709&gt;] ip_mc_source+0x84c/0xea0 net/ipv4/igmp.c:2416
[<0000000052cf19ed&gt;] do_ip_setsockopt net/ipv4/ip_sockglue.c:1294 [inline]
[<0000000052cf19ed&gt;] ip_setsockopt+0x114b/0x30c0 net/ipv4/ip_sockglue.c:1423
[<00000000477edfbc&gt;] raw_setsockopt+0x13d/0x170 net/ipv4/raw.c:857
[<00000000e75ca9bb&gt;] __sys_setsockopt+0x158/0x270 net/socket.c:2117
[<00000000bdb993a8&gt;] __do_sys_setsockopt net/socket.c:2128 [inline]
[<00000000bdb993a8&gt;] __se_sys_setsockopt net/socket.c:2125 [inline]
[<00000000bdb993a8&gt;] __x64_sys_setsockopt+0xba/0x150 net/socket.c:2125
[<000000006a1ffdbd&gt;] do_syscall_64+0x40/0x80 arch/x86/entry/common.c:47
[<00000000b11467c4&gt;] entry_SYSCALL_64_after_hwframe+0x44/0xae

In commit 24803f38a5c0 ("igmp: do not remove igmp souce list info when set
link down"), the ip_mc_clear_src() in ip_mc_destroy_dev() was removed,
because it was also called in igmpv3_clear_delrec().

Rough callgraph:

inetdev_destroy
-&gt; ip_mc_destroy_dev
-&gt; igmpv3_clear_delrec
-&gt; ip_mc_clear_src
-&gt; RCU_INIT_POINTER(dev-&gt;ip_ptr, NULL)

However, ip_mc_clear_src() called in igmpv3_clear_delrec() doesn't
release in_dev-&gt;mc_list-&gt;sources. And RCU_INIT_POINTER() assigns the
NULL to dev-&gt;ip_ptr. As a result, in_dev cannot be obtained through
inetdev_by_index() and then in_dev-&gt;mc_list-&gt;sources cannot be released
by ip_mc_del1_src() in the sock_close. Rough call sequence goes like:

sock_close
-&gt; __sock_release
-&gt; inet_release
-&gt; ip_mc_drop_socket
-&gt; inetdev_by_index
-&gt; ip_mc_leave_src
-&gt; ip_mc_del_src
-&gt; ip_mc_del1_src

So we still need to call ip_mc_clear_src() in ip_mc_destroy_dev() to free
in_dev-&gt;mc_list-&gt;sources.

2. 影响范围

3. 影响组件

4. 修复版本

5. 修复方法

6. 下载链接