lkml.org 
[lkml]   [2020]   [Apr]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] xfrm: Fix xfrm_state refcnt leak in xfrm_input()
On Thu, Apr 23, 2020 at 01:19:20PM +0800, Xiyu Yang wrote:
> xfrm_input() invokes xfrm_state_lookup(), which returns a reference of
> the specified xfrm_state object to "x" with increased refcnt and then
> "x" is escaped to "sp->xvec[]".
>
> When xfrm_input() encounters error, it calls kfree_skb() to free the
> "skb" memory. Since "sp" comes from one of "skb" fields, this "free"
> behavior causes "sp" becomes invalid, so the refcount for its field
> should be decreased to keep refcount balanced before kfree_skb() calls.
>
> The reference counting issue happens in several exception handling paths
> of xfrm_input(). When those error scenarios occur such as skb_dst()
> fails, the function forgets to decrease the refcnt increased by
> xfrm_state_lookup() and directly calls kfree_skb(), causing a refcnt
> leak.

kfree_skb() drops these refcounts already, why should we do that here
too?

\
 
 \ /
  Last update: 2020-04-23 08:02    [W:0.039 / U:0.488 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site