CVE-2021-47249

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: rds: fix memory leak in rds_recvmsg<br /> <br /> Syzbot reported memory leak in rds. The problem<br /> was in unputted refcount in case of error.<br /> <br /> int rds_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,<br /> int msg_flags)<br /> {<br /> ...<br /> <br /> if (!rds_next_incoming(rs, &amp;inc)) {<br /> ...<br /> }<br /> <br /> After this "if" inc refcount incremented and<br /> <br /> if (rds_cmsg_recv(inc, msg, rs)) {<br /> ret = -EFAULT;<br /> goto out;<br /> }<br /> ...<br /> out:<br /> return ret;<br /> }<br /> <br /> in case of rds_cmsg_recv() fail the refcount won&amp;#39;t be<br /> decremented. And it&amp;#39;s easy to see from ftrace log, that<br /> rds_inc_addref() don&amp;#39;t have rds_inc_put() pair in<br /> rds_recvmsg() after rds_cmsg_recv()<br /> <br /> 1) | rds_recvmsg() {<br /> 1) 3.721 us | rds_inc_addref();<br /> 1) 3.853 us | rds_message_inc_copy_to_user();<br /> 1) + 10.395 us | rds_cmsg_recv();<br /> 1) + 34.260 us | }