* [PATCH] vti6: Fix memory leak of skb if input policy check fails
@ 2020-03-11 10:19 Torsten Hilbrich
2020-03-12 14:18 ` Nicolas Dichtel
0 siblings, 1 reply; 3+ messages in thread
From: Torsten Hilbrich @ 2020-03-11 10:19 UTC (permalink / raw)
To: netdev; +Cc: Steffen Klassert
The vti6_rcv function performs some tests on the retrieved tunnel
including checking the IP protocol, the XFRM input policy, the
source and destination address.
In all but one places the skb is released in the error case. When
the input policy check fails the network packet is leaked.
Using the same goto-label discard in this case to fix this problem.
Signed-off-by: Torsten Hilbrich <torsten.hilbrich@secunet.com>
---
net/ipv6/ip6_vti.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index 56e642efefff..cc6180e08a4f 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -311,7 +311,7 @@ static int vti6_rcv(struct sk_buff *skb)
if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
rcu_read_unlock();
- return 0;
+ goto discard;
}
ipv6h = ipv6_hdr(skb);
--
2.17.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] vti6: Fix memory leak of skb if input policy check fails
2020-03-11 10:19 [PATCH] vti6: Fix memory leak of skb if input policy check fails Torsten Hilbrich
@ 2020-03-12 14:18 ` Nicolas Dichtel
2020-03-18 6:15 ` Steffen Klassert
0 siblings, 1 reply; 3+ messages in thread
From: Nicolas Dichtel @ 2020-03-12 14:18 UTC (permalink / raw)
To: Torsten Hilbrich, netdev; +Cc: Steffen Klassert
Le 11/03/2020 à 11:19, Torsten Hilbrich a écrit :
> The vti6_rcv function performs some tests on the retrieved tunnel
> including checking the IP protocol, the XFRM input policy, the
> source and destination address.
>
> In all but one places the skb is released in the error case. When
> the input policy check fails the network packet is leaked.
>
> Using the same goto-label discard in this case to fix this problem.
>
> Signed-off-by: Torsten Hilbrich <torsten.hilbrich@secunet.com>
Fixes: ed1efb2aefbb ("ipv6: Add support for IPsec virtual tunnel interfaces")
Reviewed-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] vti6: Fix memory leak of skb if input policy check fails
2020-03-12 14:18 ` Nicolas Dichtel
@ 2020-03-18 6:15 ` Steffen Klassert
0 siblings, 0 replies; 3+ messages in thread
From: Steffen Klassert @ 2020-03-18 6:15 UTC (permalink / raw)
To: Nicolas Dichtel; +Cc: Torsten Hilbrich, netdev
On Thu, Mar 12, 2020 at 03:18:57PM +0100, Nicolas Dichtel wrote:
> Le 11/03/2020 à 11:19, Torsten Hilbrich a écrit :
> > The vti6_rcv function performs some tests on the retrieved tunnel
> > including checking the IP protocol, the XFRM input policy, the
> > source and destination address.
> >
> > In all but one places the skb is released in the error case. When
> > the input policy check fails the network packet is leaked.
> >
> > Using the same goto-label discard in this case to fix this problem.
> >
> > Signed-off-by: Torsten Hilbrich <torsten.hilbrich@secunet.com>
> Fixes: ed1efb2aefbb ("ipv6: Add support for IPsec virtual tunnel interfaces")
> Reviewed-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Patch applied, thanks everyone!
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-03-18 6:15 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-03-11 10:19 [PATCH] vti6: Fix memory leak of skb if input policy check fails Torsten Hilbrich
2020-03-12 14:18 ` Nicolas Dichtel
2020-03-18 6:15 ` Steffen Klassert
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).