Description
In the Linux kernel, the following vulnerability has been resolved: tun: free page on build_skb failure in tun_xdp_one() When build_skb() fails in tun_xdp_one(), the function sets ret to -ENOMEM and jumps to the out label, which returns without freeing the page that vhost_net_build_xdp() allocated for the frame. As with the short-frame rejection path, tun_sendmsg() discards the per-buffer error and still returns total_len, so vhost_tx_batch() takes the success path and never frees the page. Each build_skb() failure in a batch leaks one page-frag chunk. Free the page before taking the error path, matching the put_page() the other error exits of tun_xdp_one() already perform.
Product status
043d222f93ab8c76b56a3b315cd8692e35affb6c (git) before d16e38fac09a47bfcf98c1ad65a1bb53f94540f5
043d222f93ab8c76b56a3b315cd8692e35affb6c (git) before aa308e9dbb9acb17cacdbbce9e4504f69bac8385
043d222f93ab8c76b56a3b315cd8692e35affb6c (git) before 4fefc6156a162a9f50035c12091a5e5130c82c6e
043d222f93ab8c76b56a3b315cd8692e35affb6c (git) before aa8963fdce667a42fb7f0bdd2909fadcab02f9a8
4.20
Any version before 4.20
6.12.93 (semver)
6.18.35 (semver)
7.0.12 (semver)
7.1-rc6 (original_commit_for_fix)
References
git.kernel.org/...c/d16e38fac09a47bfcf98c1ad65a1bb53f94540f5
git.kernel.org/...c/aa308e9dbb9acb17cacdbbce9e4504f69bac8385
git.kernel.org/...c/4fefc6156a162a9f50035c12091a5e5130c82c6e
git.kernel.org/...c/aa8963fdce667a42fb7f0bdd2909fadcab02f9a8