[bug report] ipv6: implement dataplane support for rthdr type 4 (Segment Routing Header)

[bug report] ipv6: implement dataplane support for rthdr type 4 (Segment Routing Header)

[Dan Carpenter]

Hello David Lebrun,

The patch 1ababeba4a21: "ipv6: implement dataplane support for rthdr
type 4 (Segment Routing Header)" from Nov 8, 2016, leads to the
following static checker warning:

	net/ipv6/exthdrs.c:391 ipv6_srh_rcv()
	error: double free of 'skb'

net/ipv6/exthdrs.c
   384  
   385          if (hdr->segments_left >= (hdr->hdrlen >> 1)) {
   386                  __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
   387                                  IPSTATS_MIB_INHDRERRORS);
   388                  icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
                                          ^^^
Freed here.

   389                                    ((&hdr->segments_left) -
   390                                     skb_network_header(skb)));
   391                  kfree_skb(skb);
                                  ^^^
And again here.

   392                  return -1;
   393          }
   394  

regards,
dan carpenter

Re: [bug report] ipv6: implement dataplane support for rthdr type 4 (Segment Routing Header)

[David Lebrun]

[-- Attachment #1.1: Type: text/plain, Size: 408 bytes --]

On 04/19/2017 03:55 PM, Dan Carpenter wrote:
> Hello David Lebrun,
> 
> The patch 1ababeba4a21: "ipv6: implement dataplane support for rthdr
> type 4 (Segment Routing Header)" from Nov 8, 2016, leads to the
> following static checker warning:
> 
> 	net/ipv6/exthdrs.c:391 ipv6_srh_rcv()
> 	error: double free of 'skb'

Thanks for the report ! I'll send a patch to fix that right now :)

David


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 195 bytes --]