From: Daniele Di Proietto <diproiettod@ovn.org>
To: netdev@vger.kernel.org
Cc: Daniele Di Proietto <diproiettod@ovn.org>,
Florian Westphal <fw@strlen.de>,
Pravin B Shelar <pshelar@ovn.org>, Joe Stringer <joe@ovn.org>
Subject: [PATCH net] openvswitch: Fix skb leak in IPv6 reassembly.
Date: Mon, 28 Nov 2016 15:43:53 -0800 [thread overview]
Message-ID: <20161128234353.4262-1-diproiettod@ovn.org> (raw)
If nf_ct_frag6_gather() returns an error other than -EINPROGRESS, it
means that we still have a reference to the skb. We should free it
before returning from handle_fragments, as stated in the comment above.
Fixes: daaa7d647f81 ("netfilter: ipv6: avoid nf_iterate recursion")
CC: Florian Westphal <fw@strlen.de>
CC: Pravin B Shelar <pshelar@ovn.org>
CC: Joe Stringer <joe@ovn.org>
Signed-off-by: Daniele Di Proietto <diproiettod@ovn.org>
---
net/openvswitch/conntrack.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index 31045ef..fecefa2 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -370,8 +370,11 @@ static int handle_fragments(struct net *net, struct sw_flow_key *key,
skb_orphan(skb);
memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
err = nf_ct_frag6_gather(net, skb, user);
- if (err)
+ if (err) {
+ if (err != -EINPROGRESS)
+ kfree_skb(skb);
return err;
+ }
key->ip.proto = ipv6_hdr(skb)->nexthdr;
ovs_cb.mru = IP6CB(skb)->frag_max_size;
--
2.10.2
next reply other threads:[~2016-11-28 23:43 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-11-28 23:43 Daniele Di Proietto [this message]
2016-11-29 0:22 ` [PATCH net] openvswitch: Fix skb leak in IPv6 reassembly Eric Dumazet
2016-11-29 0:45 ` Florian Westphal
2016-11-29 1:16 ` Joe Stringer
2016-11-29 7:39 ` Pravin Shelar
[not found] ` <CAExiqTKTbgOaXLjHMuvne__9hyNLT5kN72fOrEg2CF3VgFg3Cw@mail.gmail.com>
2016-11-29 17:21 ` Pravin Shelar
2016-11-30 16:02 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20161128234353.4262-1-diproiettod@ovn.org \
--to=diproiettod@ovn.org \
--cc=fw@strlen.de \
--cc=joe@ovn.org \
--cc=netdev@vger.kernel.org \
--cc=pshelar@ovn.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.