lkml.org 
[lkml]   [2019]   [May]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [PATCH AUTOSEL 5.1 011/375] ip6: fix skb leak in ip6frag_expire_frag_queue()
    From
    Date
    On 22.05.19 21:15, Sasha Levin wrote:
    > From: Eric Dumazet <edumazet@google.com>
    >
    > [ Upstream commit 47d3d7fdb10a21c223036b58bd70ffdc24a472c4 ]
    >
    > Since ip6frag_expire_frag_queue() now pulls the head skb
    > from frag queue, we should no longer use skb_get(), since
    > this leads to an skb leak.
    >
    > Stefan Bader initially reported a problem in 4.4.stable [1] caused
    > by the skb_get(), so this patch should also fix this issue.

    Just to let everybody know, while changing this has fixed the BUG_ON problem
    while sending (in 4.4) it now crashes when releasing just a little later.
    Still feels like the right direction but not complete, yet.

    -Stefan

    >
    > 296583.091021] kernel BUG at /build/linux-6VmqmP/linux-4.4.0/net/core/skbuff.c:1207!
    > [296583.091734] Call Trace:
    > [296583.091749] [<ffffffff81740e50>] __pskb_pull_tail+0x50/0x350
    > [296583.091764] [<ffffffff8183939a>] _decode_session6+0x26a/0x400
    > [296583.091779] [<ffffffff817ec719>] __xfrm_decode_session+0x39/0x50
    > [296583.091795] [<ffffffff818239d0>] icmpv6_route_lookup+0xf0/0x1c0
    > [296583.091809] [<ffffffff81824421>] icmp6_send+0x5e1/0x940
    > [296583.091823] [<ffffffff81753238>] ? __netif_receive_skb+0x18/0x60
    > [296583.091838] [<ffffffff817532b2>] ? netif_receive_skb_internal+0x32/0xa0
    > [296583.091858] [<ffffffffc0199f74>] ? ixgbe_clean_rx_irq+0x594/0xac0 [ixgbe]
    > [296583.091876] [<ffffffffc04eb260>] ? nf_ct_net_exit+0x50/0x50 [nf_defrag_ipv6]
    > [296583.091893] [<ffffffff8183d431>] icmpv6_send+0x21/0x30
    > [296583.091906] [<ffffffff8182b500>] ip6_expire_frag_queue+0xe0/0x120
    > [296583.091921] [<ffffffffc04eb27f>] nf_ct_frag6_expire+0x1f/0x30 [nf_defrag_ipv6]
    > [296583.091938] [<ffffffff810f3b57>] call_timer_fn+0x37/0x140
    > [296583.091951] [<ffffffffc04eb260>] ? nf_ct_net_exit+0x50/0x50 [nf_defrag_ipv6]
    > [296583.091968] [<ffffffff810f5464>] run_timer_softirq+0x234/0x330
    > [296583.091982] [<ffffffff8108a339>] __do_softirq+0x109/0x2b0
    >
    > Fixes: d4289fcc9b16 ("net: IP6 defrag: use rbtrees for IPv6 defrag")
    > Signed-off-by: Eric Dumazet <edumazet@google.com>
    > Reported-by: Stefan Bader <stefan.bader@canonical.com>
    > Cc: Peter Oskolkov <posk@google.com>
    > Cc: Florian Westphal <fw@strlen.de>
    > Signed-off-by: David S. Miller <davem@davemloft.net>
    > Signed-off-by: Sasha Levin <sashal@kernel.org>
    > ---
    > include/net/ipv6_frag.h | 1 -
    > 1 file changed, 1 deletion(-)
    >
    > diff --git a/include/net/ipv6_frag.h b/include/net/ipv6_frag.h
    > index 28aa9b30aecea..1f77fb4dc79df 100644
    > --- a/include/net/ipv6_frag.h
    > +++ b/include/net/ipv6_frag.h
    > @@ -94,7 +94,6 @@ ip6frag_expire_frag_queue(struct net *net, struct frag_queue *fq)
    > goto out;
    >
    > head->dev = dev;
    > - skb_get(head);
    > spin_unlock(&fq->q.lock);
    >
    > icmpv6_send(head, ICMPV6_TIME_EXCEED, ICMPV6_EXC_FRAGTIME, 0);
    >


    [unhandled content-type:application/pgp-signature]
    \
     
     \ /
      Last update: 2019-05-23 09:48    [W:6.071 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site