netdev - Re: [PATCH v3 net-next 4/5] ipv6: tcp: give socket pointer to control skbs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CANn89iJGYFzHi7eUQo49hmo0eTZzHvDTTqKXTxrSZvKKJXHa7g@mail.gmail.com>
Date: Wed, 18 Dec 2024 10:04:19 +0100
From: Eric Dumazet <edumazet@...gle.com>
To: Steffen Klassert <steffen.klassert@...unet.com>
Cc: Shahar Shitrit <shshitrit@...dia.com>, "brianvv@...gle.com" <brianvv@...gle.com>, 
	"davem@...emloft.net" <davem@...emloft.net>, "eric.dumazet@...il.com" <eric.dumazet@...il.com>, 
	"kuba@...nel.org" <kuba@...nel.org>, "kuniyu@...zon.com" <kuniyu@...zon.com>, 
	"martin.lau@...nel.org" <martin.lau@...nel.org>, "ncardwell@...gle.com" <ncardwell@...gle.com>, 
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>, "pabeni@...hat.com" <pabeni@...hat.com>, 
	Tariq Toukan <tariqt@...dia.com>, Gal Pressman <gal@...dia.com>, Ziyad Atiyyeh <ziyadat@...dia.com>, 
	Dror Tennenbaum <drort@...dia.com>
Subject: Re: [PATCH v3 net-next 4/5] ipv6: tcp: give socket pointer to control skbs

On Wed, Dec 18, 2024 at 9:26 AM Steffen Klassert
<steffen.klassert@...unet.com> wrote:
>
> On Mon, Dec 16, 2024 at 04:21:32PM +0100, Eric Dumazet wrote:
> > On Mon, Dec 16, 2024 at 2:29 PM Eric Dumazet <edumazet@...gle.com> wrote:
> > >
> > > On Mon, Dec 16, 2024 at 2:18 PM Shahar Shitrit <shshitrit@...dia.com> wrote:
> > > >
> > > > Hello,
> > > >
> > > >
> > > >
> > > > We observe memory leaks reported by kmemleak when using IPSec in transport mode with crypto offload.
> > > >
> > > > The leaks reproduce for TX offload, RX offload and both.
> > > >
> > > > The leaks as shown in stack trace can be seen below.
> > > >
> > > >
> > > >
> > > > The issue has been bisected to this commit 507a96737d99686ca1714c7ba1f60ac323178189.
> > > >
> > > >
> > >
> > > Nothing comes to mind. This might be an old bug in loopback paths.
> >
> > Or some XFRM assumption.
> >
> > Note that ip6_xmit() first parameter can be different than skb->sk
> >
> > Apparently, xfrm does not check this possibility.
>
> Can you provide a bit more context? I don't see the problem.


skb->sk is used in xfrm, and the assumption is that it is a full socket.

List of things that are supported, even for timewait and
request_sockets, and used in xfrm:

sk->sk_bound_dev_if
sock_net(skb->sk)
inet_sk(sk)->inet_dport;

But xfrmi_xmit2() for instance is doing :

err = dst_output(xi->net, skb->sk, skb);

Other dst_output() users use : dst_output(net, sk, skb), because sk
can be different than skb->sk

Also xfrm6_local_dontfrag() is assuming sk is an inet6 socket:

if (proto == IPPROTO_UDP || proto == IPPROTO_RAW)
     return inet6_test_bit(DONTFRAG, sk);

xfrm_lookup_with_ifid() seems ok (it uses sk_const_to_full_sk()), but
we probably miss some fixes.