Messages in this thread | | | Date | Sat, 23 Jun 2018 16:03:44 +0200 | From | Steffen Klassert <> | Subject | Re: [PATCH net] xfrm: fix missing dst_release() after policy blocking lbcast and multicast |
| |
On Thu, Jun 21, 2018 at 09:30:47AM +0300, Tommi Rantala wrote: > Fix missing dst_release() when local broadcast or multicast traffic is > xfrm policy blocked. > > For IPv4 this results to dst leak: ip_route_output_flow() allocates > dst_entry via __ip_route_output_key() and passes it to > xfrm_lookup_route(). xfrm_lookup returns ERR_PTR(-EPERM) that is > propagated. The dst that was allocated is never released. > > IPv4 local broadcast testcase: > ping -b 192.168.1.255 & > sleep 1 > ip xfrm policy add src 0.0.0.0/0 dst 192.168.1.255/32 dir out action block > > IPv4 multicast testcase: > ping 224.0.0.1 & > sleep 1 > ip xfrm policy add src 0.0.0.0/0 dst 224.0.0.1/32 dir out action block > > For IPv6 the missing dst_release() causes trouble e.g. when used in netns: > ip netns add TEST > ip netns exec TEST ip link set lo up > ip link add dummy0 type dummy > ip link set dev dummy0 netns TEST > ip netns exec TEST ip addr add fd00::1111 dev dummy0 > ip netns exec TEST ip link set dummy0 up > ip netns exec TEST ping -6 -c 5 ff02::1%dummy0 & > sleep 1 > ip netns exec TEST ip xfrm policy add src ::/0 dst ff02::1 dir out action block > wait > ip netns del TEST > > After netns deletion we see: > [ 258.239097] unregister_netdevice: waiting for lo to become free. Usage count = 2 > [ 268.279061] unregister_netdevice: waiting for lo to become free. Usage count = 2 > [ 278.367018] unregister_netdevice: waiting for lo to become free. Usage count = 2 > [ 288.375259] unregister_netdevice: waiting for lo to become free. Usage count = 2 > > Fixes: ac37e2515c1a ("xfrm: release dst_orig in case of error in xfrm_lookup()") > Signed-off-by: Tommi Rantala <tommi.t.rantala@nokia.com>
Patch applied, thanks a lot!
| |