Messages in this thread | | | Date | Thu, 23 Apr 2020 08:01:39 +0200 | From | Steffen Klassert <> | Subject | Re: [PATCH] xfrm: Fix xfrm_state refcnt leak in xfrm_input() |
| |
On Thu, Apr 23, 2020 at 01:19:20PM +0800, Xiyu Yang wrote: > xfrm_input() invokes xfrm_state_lookup(), which returns a reference of > the specified xfrm_state object to "x" with increased refcnt and then > "x" is escaped to "sp->xvec[]". > > When xfrm_input() encounters error, it calls kfree_skb() to free the > "skb" memory. Since "sp" comes from one of "skb" fields, this "free" > behavior causes "sp" becomes invalid, so the refcount for its field > should be decreased to keep refcount balanced before kfree_skb() calls. > > The reference counting issue happens in several exception handling paths > of xfrm_input(). When those error scenarios occur such as skb_dst() > fails, the function forgets to decrease the refcnt increased by > xfrm_state_lookup() and directly calls kfree_skb(), causing a refcnt > leak.
kfree_skb() drops these refcounts already, why should we do that here too?
| |