* [PATCH net 1/1] net: fix fraglist segmentation reference count leak
@ 2020-03-30 16:51 Florian Westphal
2020-03-30 16:59 ` Steffen Klassert
2020-03-30 17:43 ` David Miller
0 siblings, 2 replies; 3+ messages in thread
From: Florian Westphal @ 2020-03-30 16:51 UTC (permalink / raw)
To: netdev; +Cc: Florian Westphal, Steffen Klassert, Xiumei Mu, Xin Long
Xin Long says:
On udp rx path udp_rcv_segment() may do segment where the frag skbs
will get the header copied from the head skb in skb_segment_list()
by calling __copy_skb_header(), which could overwrite the frag skbs'
extensions by __skb_ext_copy() and cause a leak.
This issue was found after loading esp_offload where a sec path ext
is set in the skb.
Fix this by discarding head state of the fraglist skb before replacing
its contents.
Fixes: 3a1296a38d0cf62 ("net: Support GRO/GSO fraglist chaining.")
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Reported-by: Xiumei Mu <xmu@redhat.com>
Tested-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
---
net/core/skbuff.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index e1101a4f90a6..bea447f38dcc 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3668,6 +3668,7 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb,
skb_push(nskb, -skb_network_offset(nskb) + offset);
+ skb_release_head_state(nskb);
__copy_skb_header(nskb, skb);
skb_headers_offset_update(nskb, skb_headroom(nskb) - skb_headroom(skb));
--
2.24.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH net 1/1] net: fix fraglist segmentation reference count leak
2020-03-30 16:51 [PATCH net 1/1] net: fix fraglist segmentation reference count leak Florian Westphal
@ 2020-03-30 16:59 ` Steffen Klassert
2020-03-30 17:43 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: Steffen Klassert @ 2020-03-30 16:59 UTC (permalink / raw)
To: Florian Westphal; +Cc: netdev, Xiumei Mu, Xin Long
On Mon, Mar 30, 2020 at 06:51:29PM +0200, Florian Westphal wrote:
> Xin Long says:
> On udp rx path udp_rcv_segment() may do segment where the frag skbs
> will get the header copied from the head skb in skb_segment_list()
> by calling __copy_skb_header(), which could overwrite the frag skbs'
> extensions by __skb_ext_copy() and cause a leak.
>
> This issue was found after loading esp_offload where a sec path ext
> is set in the skb.
>
> Fix this by discarding head state of the fraglist skb before replacing
> its contents.
>
> Fixes: 3a1296a38d0cf62 ("net: Support GRO/GSO fraglist chaining.")
> Cc: Steffen Klassert <steffen.klassert@secunet.com>
> Reported-by: Xiumei Mu <xmu@redhat.com>
> Tested-by: Xin Long <lucien.xin@gmail.com>
> Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Steffen Klassert <steffen.klassert@secunet.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH net 1/1] net: fix fraglist segmentation reference count leak
2020-03-30 16:51 [PATCH net 1/1] net: fix fraglist segmentation reference count leak Florian Westphal
2020-03-30 16:59 ` Steffen Klassert
@ 2020-03-30 17:43 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: David Miller @ 2020-03-30 17:43 UTC (permalink / raw)
To: fw; +Cc: netdev, steffen.klassert, xmu, lucien.xin
From: Florian Westphal <fw@strlen.de>
Date: Mon, 30 Mar 2020 18:51:29 +0200
> Xin Long says:
> On udp rx path udp_rcv_segment() may do segment where the frag skbs
> will get the header copied from the head skb in skb_segment_list()
> by calling __copy_skb_header(), which could overwrite the frag skbs'
> extensions by __skb_ext_copy() and cause a leak.
>
> This issue was found after loading esp_offload where a sec path ext
> is set in the skb.
>
> Fix this by discarding head state of the fraglist skb before replacing
> its contents.
>
> Fixes: 3a1296a38d0cf62 ("net: Support GRO/GSO fraglist chaining.")
> Cc: Steffen Klassert <steffen.klassert@secunet.com>
> Reported-by: Xiumei Mu <xmu@redhat.com>
> Tested-by: Xin Long <lucien.xin@gmail.com>
> Signed-off-by: Florian Westphal <fw@strlen.de>
Applied and queued up for v5.6 -stable, thanks.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-03-30 17:43 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-03-30 16:51 [PATCH net 1/1] net: fix fraglist segmentation reference count leak Florian Westphal
2020-03-30 16:59 ` Steffen Klassert
2020-03-30 17:43 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).