netdev - Re: [PATCH net-next] ipv6: rpl: free skb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240910204010.96400-1-kuniyu@amazon.com>
Date: Tue, 10 Sep 2024 13:40:10 -0700
From: Kuniyuki Iwashima <kuniyu@...zon.com>
To: <justin.iurman@...ege.be>
CC: <aahringo@...hat.com>, <davem@...emloft.net>, <dsahern@...nel.org>,
	<edumazet@...gle.com>, <kuba@...nel.org>, <linux-kernel@...r.kernel.org>,
	<netdev@...r.kernel.org>, <pabeni@...hat.com>
Subject: Re: [PATCH net-next] ipv6: rpl: free skb

From: Justin Iurman <justin.iurman@...ege.be>
Date: Tue, 10 Sep 2024 12:00:32 +0200
> Make rpl_input() free the skb before returning when skb_cow_head()
> fails. Use a "drop" label and goto instructions.
> 
> Note: if you think it should be a fix and target "net" instead, let me
> know.

Please do so.

For the future submission, this kind of note and changelog between
each revision can be placed after '---' below so that it will disappear
during merge.

> 
> Signed-off-by: Justin Iurman <justin.iurman@...ege.be>
> ---
>  net/ipv6/rpl_iptunnel.c | 12 +++++++-----
>  1 file changed, 7 insertions(+), 5 deletions(-)
> 
> diff --git a/net/ipv6/rpl_iptunnel.c b/net/ipv6/rpl_iptunnel.c
> index 2c83b7586422..db3c19a42e1c 100644
> --- a/net/ipv6/rpl_iptunnel.c
> +++ b/net/ipv6/rpl_iptunnel.c
> @@ -263,10 +263,8 @@ static int rpl_input(struct sk_buff *skb)
>  	rlwt = rpl_lwt_lwtunnel(orig_dst->lwtstate);
>  
>  	err = rpl_do_srh(skb, rlwt);
> -	if (unlikely(err)) {
> -		kfree_skb(skb);
> -		return err;
> -	}
> +	if (unlikely(err))
> +		goto drop;
>  
>  	local_bh_disable();
>  	dst = dst_cache_get(&rlwt->cache);
> @@ -286,9 +284,13 @@ static int rpl_input(struct sk_buff *skb)
>  
>  	err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev));
>  	if (unlikely(err))
> -		return err;
> +		goto drop;
>  
>  	return dst_input(skb);
> +
> +drop:
> +	kfree_skb(skb);
> +	return err;
>  }
>  
>  static int nla_put_rpl_srh(struct sk_buff *skb, int attrtype,
> --