lkml.org 
[lkml]   [2020]   [Apr]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 075/116] vti6: Fix memory leak of skb if input policy check fails
    Date
    From: Torsten Hilbrich <torsten.hilbrich@secunet.com>

    commit 2a9de3af21aa8c31cd68b0b39330d69f8c1e59df upstream.

    The vti6_rcv function performs some tests on the retrieved tunnel
    including checking the IP protocol, the XFRM input policy, the
    source and destination address.

    In all but one places the skb is released in the error case. When
    the input policy check fails the network packet is leaked.

    Using the same goto-label discard in this case to fix this problem.

    Fixes: ed1efb2aefbb ("ipv6: Add support for IPsec virtual tunnel interfaces")
    Signed-off-by: Torsten Hilbrich <torsten.hilbrich@secunet.com>
    Reviewed-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
    Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    net/ipv6/ip6_vti.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/net/ipv6/ip6_vti.c
    +++ b/net/ipv6/ip6_vti.c
    @@ -315,7 +315,7 @@ static int vti6_rcv(struct sk_buff *skb)

    if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
    rcu_read_unlock();
    - return 0;
    + goto discard;
    }

    ipv6h = ipv6_hdr(skb);

    \
     
     \ /
      Last update: 2020-04-01 18:27    [W:4.136 / U:0.616 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site