CVE-2021-47238

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: ipv4: fix memory leak in ip_mc_add1_src<br /> <br /> BUG: memory leak<br /> unreferenced object 0xffff888101bc4c00 (size 32):<br /> comm "syz-executor527", pid 360, jiffies 4294807421 (age 19.329s)<br /> hex dump (first 32 bytes):<br /> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................<br /> 01 00 00 00 00 00 00 00 ac 14 14 bb 00 00 02 00 ................<br /> backtrace:<br /> [] kmalloc include/linux/slab.h:558 [inline]<br /> [] kzalloc include/linux/slab.h:688 [inline]<br /> [] ip_mc_add1_src net/ipv4/igmp.c:1971 [inline]<br /> [] ip_mc_add_src+0x95f/0xdb0 net/ipv4/igmp.c:2095<br /> [] ip_mc_source+0x84c/0xea0 net/ipv4/igmp.c:2416<br /> [] do_ip_setsockopt net/ipv4/ip_sockglue.c:1294 [inline]<br /> [] ip_setsockopt+0x114b/0x30c0 net/ipv4/ip_sockglue.c:1423<br /> [] raw_setsockopt+0x13d/0x170 net/ipv4/raw.c:857<br /> [] __sys_setsockopt+0x158/0x270 net/socket.c:2117<br /> [] __do_sys_setsockopt net/socket.c:2128 [inline]<br /> [] __se_sys_setsockopt net/socket.c:2125 [inline]<br /> [] __x64_sys_setsockopt+0xba/0x150 net/socket.c:2125<br /> [] do_syscall_64+0x40/0x80 arch/x86/entry/common.c:47<br /> [] entry_SYSCALL_64_after_hwframe+0x44/0xae<br /> <br /> In commit 24803f38a5c0 ("igmp: do not remove igmp souce list info when set<br /> link down"), the ip_mc_clear_src() in ip_mc_destroy_dev() was removed,<br /> because it was also called in igmpv3_clear_delrec().<br /> <br /> Rough callgraph:<br /> <br /> inetdev_destroy<br /> -&gt; ip_mc_destroy_dev<br /> -&gt; igmpv3_clear_delrec<br /> -&gt; ip_mc_clear_src<br /> -&gt; RCU_INIT_POINTER(dev-&gt;ip_ptr, NULL)<br /> <br /> However, ip_mc_clear_src() called in igmpv3_clear_delrec() doesn&amp;#39;t<br /> release in_dev-&gt;mc_list-&gt;sources. And RCU_INIT_POINTER() assigns the<br /> NULL to dev-&gt;ip_ptr. As a result, in_dev cannot be obtained through<br /> inetdev_by_index() and then in_dev-&gt;mc_list-&gt;sources cannot be released<br /> by ip_mc_del1_src() in the sock_close. Rough call sequence goes like:<br /> <br /> sock_close<br /> -&gt; __sock_release<br /> -&gt; inet_release<br /> -&gt; ip_mc_drop_socket<br /> -&gt; inetdev_by_index<br /> -&gt; ip_mc_leave_src<br /> -&gt; ip_mc_del_src<br /> -&gt; ip_mc_del1_src<br /> <br /> So we still need to call ip_mc_clear_src() in ip_mc_destroy_dev() to free<br /> in_dev-&gt;mc_list-&gt;sources.