CVE-2021-47238

In the Linux kernel, the following vulnerability has been resolved: net:
ipv4: fix memory leak in ip_mc_add1_src BUG: memory leak unreferenced
object 0xffff888101bc4c00 (size 32): comm “syz-executor527”, pid 360,
jiffies 4294807421 (age 19.329s) hex dump (first 32 bytes): 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 … 01 00 00 00 00 00 00 00
ac 14 14 bb 00 00 02 00 … backtrace: [<00000000f17c5244>]
kmalloc include/linux/slab.h:558 [inline] [<00000000f17c5244>] kzalloc
include/linux/slab.h:688 [inline] [<00000000f17c5244>] ip_mc_add1_src
net/ipv4/igmp.c:1971 [inline] [<00000000f17c5244>]
ip_mc_add_src+0x95f/0xdb0 net/ipv4/igmp.c:2095 [<000000001cb99709>]
ip_mc_source+0x84c/0xea0 net/ipv4/igmp.c:2416 [<0000000052cf19ed>]
do_ip_setsockopt net/ipv4/ip_sockglue.c:1294 [inline] [<0000000052cf19ed>]
ip_setsockopt+0x114b/0x30c0 net/ipv4/ip_sockglue.c:1423
[<00000000477edfbc>] raw_setsockopt+0x13d/0x170 net/ipv4/raw.c:857
[<00000000e75ca9bb>] __sys_setsockopt+0x158/0x270 net/socket.c:2117
[<00000000bdb993a8>] __do_sys_setsockopt net/socket.c:2128 [inline]
[<00000000bdb993a8>] __se_sys_setsockopt net/socket.c:2125 [inline]
[<00000000bdb993a8>] __x64_sys_setsockopt+0xba/0x150 net/socket.c:2125
[<000000006a1ffdbd>] do_syscall_64+0x40/0x80 arch/x86/entry/common.c:47
[<00000000b11467c4>] entry_SYSCALL_64_after_hwframe+0x44/0xae In commit
24803f38a5c0 (“igmp: do not remove igmp souce list info when set link
down”), the ip_mc_clear_src() in ip_mc_destroy_dev() was removed, because
it was also called in igmpv3_clear_delrec(). Rough callgraph:
inetdev_destroy -> ip_mc_destroy_dev -> igmpv3_clear_delrec ->
ip_mc_clear_src -> RCU_INIT_POINTER(dev->ip_ptr, NULL) However,
ip_mc_clear_src() called in igmpv3_clear_delrec() doesn’t release
in_dev->mc_list->sources. And RCU_INIT_POINTER() assigns the NULL to
dev->ip_ptr. As a result, in_dev cannot be obtained through
inetdev_by_index() and then in_dev->mc_list->sources cannot be released by
ip_mc_del1_src() in the sock_close. Rough call sequence goes like:
sock_close -> __sock_release -> inet_release -> ip_mc_drop_socket ->
inetdev_by_index -> ip_mc_leave_src -> ip_mc_del_src -> ip_mc_del1_src So
we still need to call ip_mc_clear_src() in ip_mc_destroy_dev() to free
in_dev->mc_list->sources.