Messages in this thread | | | Date | Fri, 17 May 2024 13:22:38 +0100 | From | Simon Horman <> | Subject | Re: [PATCH] net: esp: cleanup esp_output_tail_tcp() in case of unsupported ESPINTCP |
| |
On Thu, May 16, 2024 at 08:03:09AM +0000, Hagar Hemdan wrote: > xmit() functions should consume skb or return error codes in error > paths. > When the configuration "CONFIG_INET_ESPINTCP" is not used, the > implementation of the function "esp_output_tail_tcp" violates this rule. > The function frees the skb and returns the error code. > This change removes the kfree_skb from both functions, for both > esp4 and esp6. > > This should not be reachable in the current code, so this change is just > a cleanup. > > This bug was discovered and resolved using Coverity Static Analysis > Security Testing (SAST) by Synopsys, Inc. > > Fixes: e27cca96cd68 ("xfrm: add espintcp (RFC 8229)") > Signed-off-by: Hagar Hemdan <hagarhem@amazon.com>
Hi Hagar,
If esp_output() may be the x->type->output callback called from esp_output() then I agree that this seems to be a problem as it looks like a double free may occur.
However, I believe that your proposed fix introduces will result in skb being leaked leak in the case of esp_output_done() calling esp_output_tail_tcp(). Perhaps a solution is for esp_output_done() to free the skb if esp_output_tail_tcp() fails.
I did not analyse other call-chains, but I think such analysis is needed.
..
| |