diff options
| author |   Kees Cook <keescook@chromium.org> | 2014-04-16 10:54:34 -0700 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2014-04-16 15:25:53 -0400 |
| commit | 0acf07d240a84069c4a6651e6030cf35d30c7159 (patch) | |
| tree | 6a3fea10ea8fc9d17f402e5e0f68ee2cda1de21f /net/8021q/vlan_dev.c | |
| parent | isdn: icn: buffer overflow in icn_command() (diff) | |
| download | linux-dev-0acf07d240a84069c4a6651e6030cf35d30c7159.tar.xz linux-dev-0acf07d240a84069c4a6651e6030cf35d30c7159.zip | |
seccomp: fix memory leak on filter attach
This sets the correct error code when final filter memory is unavailable,
and frees the raw filter no matter what.
unreferenced object 0xffff8800d6ea4000 (size 512):
comm "sshd", pid 278, jiffies 4294898315 (age 46.653s)
hex dump (first 32 bytes):
21 00 00 00 04 00 00 00 15 00 01 00 3e 00 00 c0 !...........>...
06 00 00 00 00 00 00 00 21 00 00 00 00 00 00 00 ........!.......
backtrace:
[<ffffffff8151414e>] kmemleak_alloc+0x4e/0xb0
[<ffffffff811a3a40>] __kmalloc+0x280/0x320
[<ffffffff8110842e>] prctl_set_seccomp+0x11e/0x3b0
[<ffffffff8107bb6b>] SyS_prctl+0x3bb/0x4a0
[<ffffffff8152ef2d>] system_call_fastpath+0x1a/0x1f
[<ffffffffffffffff>] 0xffffffffffffffff
Reported-by: Masami Ichikawa <masami256@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Tested-by: Masami Ichikawa <masami256@gmail.com>
Acked-by: Daniel Borkmann <dborkman@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/8021q/vlan_dev.c')
0 files changed, 0 insertions, 0 deletions