Bug 522331 (CVE-2009-2903)

Reported by Mark Smith:
When the handle_ip_over_ddp() function checks for the "ipddp0" device and the device is not found, the function does not free the socket buffer structure (skb), leading to a memory leak. This only happens if you have the appletalk module loaded, but not the ipddp module, as this only happens when the "ipddp0" device does not exist.

For details see http://kbase.redhat.com/faq/docs/DOC-19077.

Analysis:
call path: ltalk_rcv -> atalk_rcv -> handle_ip_over_ddp

net/appletalk/ddp.c:
1382 /**
1383  *  atalk_rcv - Receive a packet (in skb) from device dev
1384  *  @skb - packet received
1385  *  @dev - network device where the packet comes from
1386  *  @pt - packet type
1387  *
1388  *  Receive a packet (in skb) from device dev. This has come from the SNAP
1389  *  decoder, and on entry skb->transport_header is the DDP header, skb->len
1390  *  is the DDP header, skb->len is the DDP length. The physical headers
1391  *  have been extracted. PPP should probably pass frames marked as for this
1392  *  layer.  [ie ARPHRD_ETHERTALK]
1393  */
1394 static int atalk_rcv(struct sk_buff *skb, struct net_device *dev,
1395              struct packet_type *pt, struct net_device *orig_dev)
1396 {
[...]
1456     /* if IP over DDP is not selected this code will be optimized out */
1457     if (is_ip_over_ddp(skb))
1458         return handle_ip_over_ddp(skb);

1267 static int handle_ip_over_ddp(struct sk_buff *skb)
1268 {
1269     struct net_device *dev = __dev_get_by_name(&init_net, "ipddp0");
1270     struct net_device_stats *stats;
1271 
1272     /* This needs to be able to handle ipddp"N" devices */
1273     if (!dev)
1274         return -ENODEV; <-- did not call kfree_skb(skb) when the ipddp
                                 module is not loaded, and thus the device does
                                 not exist.

Also in linux-2.4.37.y:
   1360 /*
   1361  * Receive a packet (in skb) from device dev. This has come from the SNAP
   1362  * decoder, and on entry skb->h.raw is the DDP header, skb->len is the DDP
   1363  * header, skb->len is the DDP length. The physical headers have been
   1364  * extracted. PPP should probably pass frames marked as for this layer.
   1365  * [ie ARPHRD_ETHERTALK]
   1366  */
   1367 static int atalk_rcv(struct sk_buff *skb, struct net_device *dev,
   1368                         struct packet_type *pt)
   1369 {
[...]
   1496 #if defined(CONFIG_IPDDP) || defined(CONFIG_IPDDP_MODULE)
   1497         /* Check if IP-over-DDP */
   1498         if (skb->data[12] == 22) {
   1499                 struct net_device *dev = __dev_get_by_name("ipddp0");
   1500                 struct net_device_stats *stats;
   1501 
   1502                 /* This needs to be able to handle ipddp"N" devices */
   1503                 if (!dev)
   1504                         return -ENODEV; <-- did not call kfree_skb too
[...]
   1536 freeit: kfree_skb(skb);
   1537 out:    return 0;
   1538 }

The patch also improved the aarp_send_ddp() function so that it handles failures and frees up of skb properly, rather than depending it on the caller.