netdev - RE: missing kfree_skb(skb) in ipv6_frag

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2134F8430051B64F815C691A62D9831811037E@XCH-BLV-504.nw.nos.boeing.com>
Date:	Mon, 23 Sep 2013 19:32:37 +0000
From:	"Templin, Fred L" <Fred.L.Templin@...ing.com>
To:	Eric Dumazet <eric.dumazet@...il.com>
CC:	"netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: RE: missing kfree_skb(skb) in ipv6_frag_rcv()?

Hi Eric,

Thanks for the correction - I think I lost track of the code I
should have been looking at.

Fred

> -----Original Message-----
> From: Eric Dumazet [mailto:eric.dumazet@...il.com]
> Sent: Monday, September 23, 2013 11:37 AM
> To: Templin, Fred L
> Cc: netdev@...r.kernel.org
> Subject: Re: missing kfree_skb(skb) in ipv6_frag_rcv()?
> 
> On Mon, 2013-09-23 at 17:42 +0000, Templin, Fred L wrote:
> > Hello,
> >
> > In the most recent kernel releases, in ./net/ipv6/reassembly.c,
> > I see the following code at the end of "ipv6_frag_rcv()":
> >
> > +	IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)),
> IPSTATS_MIB_REASMFAILS);
> > +	kfree_skb(skb);
> > +	return -1;
> > +
> > +fail_hdr:
> > +	IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
> IPSTATS_MIB_INHDRERRORS);
> > +	icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
> skb_network_header_len(skb));
> > +	return -1;
> > +}
> >
> > Perhaps I missed it, but I did not find anywhere that
> 'icmpv6_param_prob()'
> > frees the skb, and hence it appears that there is a missing
> kfree_skb()
> > in the above code. Is this a bug?
> 
> void icmpv6_param_prob(struct sk_buff *skb, u8 code, int pos)
> {
>         icmp6_send(skb, ICMPV6_PARAMPROB, code, pos);
>         kfree_skb(skb);
> }
> 
> Well, I do see kfree_skb(skb) here.
>