Commit message: net: qrtr: fix memort leak in qrtr_tun_write_iter

In qrtr_tun_write_iter the allocated kbuf should be release in case of
error or success return.

v2 Update: Thanks to David Miller for pointing out the release on success
path as well.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
CVE: CVE-2019-19079
CWE: CWE-703
Vulnerability description: A memory leak in the qrtr_tun_write_iter() function in net/qrtr/tun.c in the Linux kernel before 5.3 allows attackers to cause a denial of service (memory consumption), aka CID-a21b7f0cff19.

Project: linux
File: tun.c

static ssize_t qrtr_tun_write_iter(struct kiocb *iocb, struct iov_iter *from)
{
	struct file *filp = iocb->ki_filp;
	struct qrtr_tun *tun = filp->private_data;
	size_t len = iov_iter_count(from);
	ssize_t ret;
	void *kbuf;

	kbuf = kzalloc(len, GFP_KERNEL);
	if (!kbuf)
		return -ENOMEM;

	if (!copy_from_iter_full(kbuf, len, from)) {
		kfree(kbuf);
		return -EFAULT;
	}

	ret = qrtr_endpoint_post(&tun->ep, kbuf, len);

	kfree(kbuf);
	return ret < 0 ? ret : len;
}

Project: linux
File: tun.c

static int qrtr_tun_send(struct qrtr_endpoint *ep, struct sk_buff *skb)
{
	struct qrtr_tun *tun = container_of(ep, struct qrtr_tun, ep);

	skb_queue_tail(&tun->queue, skb);

	/* wake up any blocking processes, waiting for new data */
	wake_up_interruptible(&tun->readq);

	return 0;
}

Project: linux
File: tun.c

static void __exit qrtr_tun_exit(void)
{
	misc_deregister(&qrtr_tun_miscdev);
}

Project: linux
File: tun.c

static ssize_t qrtr_tun_read_iter(struct kiocb *iocb, struct iov_iter *to)
{
	struct file *filp = iocb->ki_filp;
	struct qrtr_tun *tun = filp->private_data;
	struct sk_buff *skb;
	int count;

	while (!(skb = skb_dequeue(&tun->queue))) {
		if (filp->f_flags & O_NONBLOCK)
			return -EAGAIN;

		/* Wait until we get data or the endpoint goes away */
		if (wait_event_interruptible(tun->readq,
					     !skb_queue_empty(&tun->queue)))
			return -ERESTARTSYS;
	}

	count = min_t(size_t, iov_iter_count(to), skb->len);
	if (copy_to_iter(skb->data, count, to) != count)
		count = -EFAULT;

	kfree_skb(skb);

	return count;
}

Project: linux
File: tun.c

static int __init qrtr_tun_init(void)
{
	int ret;

	ret = misc_register(&qrtr_tun_miscdev);
	if (ret)
		pr_err("failed to register Qualcomm IPC Router tun device\n");

	return ret;
}

Project: linux
File: tun.c

static __poll_t qrtr_tun_poll(struct file *filp, poll_table *wait)
{
	struct qrtr_tun *tun = filp->private_data;
	__poll_t mask = 0;

	poll_wait(filp, &tun->readq, wait);

	if (!skb_queue_empty(&tun->queue))
		mask |= EPOLLIN | EPOLLRDNORM;

	return mask;
}

Project: linux
File: tun.c

static int qrtr_tun_open(struct inode *inode, struct file *filp)
{
	struct qrtr_tun *tun;

	tun = kzalloc(sizeof(*tun), GFP_KERNEL);
	if (!tun)
		return -ENOMEM;

	skb_queue_head_init(&tun->queue);
	init_waitqueue_head(&tun->readq);

	tun->ep.xmit = qrtr_tun_send;

	filp->private_data = tun;

	return qrtr_endpoint_register(&tun->ep, QRTR_EP_NID_AUTO);
}

Project: linux
File: tun.c

static int qrtr_tun_release(struct inode *inode, struct file *filp)
{
	struct qrtr_tun *tun = filp->private_data;
	struct sk_buff *skb;

	qrtr_endpoint_unregister(&tun->ep);

	/* Discard all SKBs */
	while (!skb_queue_empty(&tun->queue)) {
		skb = skb_dequeue(&tun->queue);
		kfree_skb(skb);
	}

	kfree(tun);

	return 0;
}