lkml.org 
[lkml]   [2024]   [May]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] net: esp: cleanup esp_output_tail_tcp() in case of unsupported ESPINTCP
On Thu, May 16, 2024 at 08:03:09AM +0000, Hagar Hemdan wrote:
> xmit() functions should consume skb or return error codes in error
> paths.
> When the configuration "CONFIG_INET_ESPINTCP" is not used, the
> implementation of the function "esp_output_tail_tcp" violates this rule.
> The function frees the skb and returns the error code.
> This change removes the kfree_skb from both functions, for both
> esp4 and esp6.
>
> This should not be reachable in the current code, so this change is just
> a cleanup.
>
> This bug was discovered and resolved using Coverity Static Analysis
> Security Testing (SAST) by Synopsys, Inc.
>
> Fixes: e27cca96cd68 ("xfrm: add espintcp (RFC 8229)")
> Signed-off-by: Hagar Hemdan <hagarhem@amazon.com>

Hi Hagar,

If esp_output() may be the x->type->output callback called from esp_output()
then I agree that this seems to be a problem as it looks like a double free
may occur.

However, I believe that your proposed fix introduces will result in skb
being leaked leak in the case of esp_output_done() calling
esp_output_tail_tcp(). Perhaps a solution is for esp_output_done()
to free the skb if esp_output_tail_tcp() fails.

I did not analyse other call-chains, but I think such analysis is needed.

..

\
 
 \ /
  Last update: 2024-05-27 18:30    [W:0.031 / U:1.124 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site