netdev - Re: [PATCH net] net: mctp: take ownership of skb in mctp_local

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 19 Feb 2024 09:52:47 +0000
From: Simon Horman <horms@...nel.org>
To: Jeremy Kerr <jk@...econstruct.com.au>
Cc: netdev@...r.kernel.org, Matt Johnston <matt@...econstruct.com.au>,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>
Subject: Re: [PATCH net] net: mctp: take ownership of skb in mctp_local_output

On Thu, Feb 15, 2024 at 03:53:09PM +0800, Jeremy Kerr wrote:
> Currently, mctp_local_output only takes ownership of skb on success, and
> we may leak an skb if mctp_local_output fails in specific states; the
> skb ownership isn't transferred until the actual output routing occurs.
> 
> Instead, make mctp_local_output free the skb on all error paths up to
> the route action, so it always consumes the passed skb.
> 
> Fixes: 833ef3b91de6 ("mctp: Populate socket implementation")
> Signed-off-by: Jeremy Kerr <jk@...econstruct.com.au>

...

> diff --git a/net/mctp/route.c b/net/mctp/route.c
> index 7a47a58aa54b..a64788bc40a8 100644
> --- a/net/mctp/route.c
> +++ b/net/mctp/route.c
> @@ -888,7 +888,7 @@ int mctp_local_output(struct sock *sk, struct mctp_route *rt,
>  		dev = dev_get_by_index_rcu(sock_net(sk), cb->ifindex);
>  		if (!dev) {
>  			rcu_read_unlock();
> -			return rc;
> +			goto out_free;
>  		}
>  		rt->dev = __mctp_dev_get(dev);
>  		rcu_read_unlock();
> @@ -903,7 +903,7 @@ int mctp_local_output(struct sock *sk, struct mctp_route *rt,
>  		rt->mtu = 0;
>  
>  	} else {
> -		return -EINVAL;
> +		goto out_free;

Hi Jeremy,

Previously this path returned -EINVAL. Now it will return rc.
But by my reading rc is set to -ENODEV here.
Should that be addressed?

>  	}
>  
>  	spin_lock_irqsave(&rt->dev->addrs_lock, flags);
> @@ -966,12 +966,17 @@ int mctp_local_output(struct sock *sk, struct mctp_route *rt,
>  		rc = mctp_do_fragment_route(rt, skb, mtu, tag);
>  	}
>  
> +	/* route output functions consume the skb, even on error */
> +	skb = NULL;
> +
>  out_release:
>  	if (!ext_rt)
>  		mctp_route_release(rt);
>  
>  	mctp_dev_put(tmp_rt.dev);
>  
> +out_free:
> +	kfree_skb(skb);
>  	return rc;
>  }
>  
> -- 
> 2.39.2
> 
>