| Message ID | 5fe49744-88ca-a7ac-d71c-223492811545@secunet.com |
|---|---|
| State | Awaiting Upstream |
| Delegated to: | David Miller |
| Headers | show |
| Series | vti6: Fix memory leak of skb if input policy check fails | expand |
Le 11/03/2020 à 11:19, Torsten Hilbrich a écrit : > The vti6_rcv function performs some tests on the retrieved tunnel > including checking the IP protocol, the XFRM input policy, the > source and destination address. > > In all but one places the skb is released in the error case. When > the input policy check fails the network packet is leaked. > > Using the same goto-label discard in this case to fix this problem. > > Signed-off-by: Torsten Hilbrich <torsten.hilbrich@secunet.com> Fixes: ed1efb2aefbb ("ipv6: Add support for IPsec virtual tunnel interfaces") Reviewed-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
On Thu, Mar 12, 2020 at 03:18:57PM +0100, Nicolas Dichtel wrote: > Le 11/03/2020 à 11:19, Torsten Hilbrich a écrit : > > The vti6_rcv function performs some tests on the retrieved tunnel > > including checking the IP protocol, the XFRM input policy, the > > source and destination address. > > > > In all but one places the skb is released in the error case. When > > the input policy check fails the network packet is leaked. > > > > Using the same goto-label discard in this case to fix this problem. > > > > Signed-off-by: Torsten Hilbrich <torsten.hilbrich@secunet.com> > Fixes: ed1efb2aefbb ("ipv6: Add support for IPsec virtual tunnel interfaces") > Reviewed-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Patch applied, thanks everyone!
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c index 56e642efefff..cc6180e08a4f 100644 --- a/net/ipv6/ip6_vti.c +++ b/net/ipv6/ip6_vti.c @@ -311,7 +311,7 @@ static int vti6_rcv(struct sk_buff *skb) if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) { rcu_read_unlock(); - return 0; + goto discard; } ipv6h = ipv6_hdr(skb);
The vti6_rcv function performs some tests on the retrieved tunnel including checking the IP protocol, the XFRM input policy, the source and destination address. In all but one places the skb is released in the error case. When the input policy check fails the network packet is leaked. Using the same goto-label discard in this case to fix this problem. Signed-off-by: Torsten Hilbrich <torsten.hilbrich@secunet.com> --- net/ipv6/ip6_vti.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)