lkml.org 
[lkml]   [2017]   [Mar]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.12 074/113] dccp: fix freeing skb too early for IPV6_RECVPKTINFO
    Date
    From: Andrey Konovalov <andreyknvl@google.com>

    3.12-stable review patch. If anyone has any objections, please let me know.

    ===============

    [ Upstream commit 5edabca9d4cff7f1f2b68f0bac55ef99d9798ba4 ]

    In the current DCCP implementation an skb for a DCCP_PKT_REQUEST packet
    is forcibly freed via __kfree_skb in dccp_rcv_state_process if
    dccp_v6_conn_request successfully returns.

    However, if IPV6_RECVPKTINFO is set on a socket, the address of the skb
    is saved to ireq->pktopts and the ref count for skb is incremented in
    dccp_v6_conn_request, so skb is still in use. Nevertheless, it gets freed
    in dccp_rcv_state_process.

    Fix by calling consume_skb instead of doing goto discard and therefore
    calling __kfree_skb.

    Similar fixes for TCP:

    fb7e2399ec17f1004c0e0ccfd17439f8759ede01 [TCP]: skb is unexpectedly freed.
    0aea76d35c9651d55bbaf746e7914e5f9ae5a25d tcp: SYN packets are now
    simply consumed

    Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
    Acked-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>
    ---
    net/dccp/input.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    diff --git a/net/dccp/input.c b/net/dccp/input.c
    index 14cdafad7a90..e511ccc74a07 100644
    --- a/net/dccp/input.c
    +++ b/net/dccp/input.c
    @@ -606,7 +606,8 @@ int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
    if (inet_csk(sk)->icsk_af_ops->conn_request(sk,
    skb) < 0)
    return 1;
    - goto discard;
    + consume_skb(skb);
    + return 0;
    }
    if (dh->dccph_type == DCCP_PKT_RESET)
    goto discard;
    --
    2.12.0
    \
     
     \ /
      Last update: 2017-03-06 10:26    [W:4.166 / U:0.000 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site