a8891c5e22
[ Upstream commit 47d3d7fdb10a21c223036b58bd70ffdc24a472c4 ]
Since ip6frag_expire_frag_queue() now pulls the head skb
from frag queue, we should no longer use skb_get(), since
this leads to an skb leak.
Stefan Bader initially reported a problem in 4.4.stable [1] caused
by the skb_get(), so this patch should also fix this issue.
296583.091021] kernel BUG at /build/linux-6VmqmP/linux-4.4.0/net/core/skbuff.c:1207!
[296583.091734] Call Trace:
[296583.091749] [<ffffffff81740e50>] __pskb_pull_tail+0x50/0x350
[296583.091764] [<ffffffff8183939a>] _decode_session6+0x26a/0x400
[296583.091779] [<ffffffff817ec719>] __xfrm_decode_session+0x39/0x50
[296583.091795] [<ffffffff818239d0>] icmpv6_route_lookup+0xf0/0x1c0
[296583.091809] [<ffffffff81824421>] icmp6_send+0x5e1/0x940
[296583.091823] [<ffffffff81753238>] ? __netif_receive_skb+0x18/0x60
[296583.091838] [<ffffffff817532b2>] ? netif_receive_skb_internal+0x32/0xa0
[296583.091858] [<ffffffffc0199f74>] ? ixgbe_clean_rx_irq+0x594/0xac0 [ixgbe]
[296583.091876] [<ffffffffc04eb260>] ? nf_ct_net_exit+0x50/0x50 [nf_defrag_ipv6]
[296583.091893] [<ffffffff8183d431>] icmpv6_send+0x21/0x30
[296583.091906] [<ffffffff8182b500>] ip6_expire_frag_queue+0xe0/0x120
[296583.091921] [<ffffffffc04eb27f>] nf_ct_frag6_expire+0x1f/0x30 [nf_defrag_ipv6]
[296583.091938] [<ffffffff810f3b57>] call_timer_fn+0x37/0x140
[296583.091951] [<ffffffffc04eb260>] ? nf_ct_net_exit+0x50/0x50 [nf_defrag_ipv6]
[296583.091968] [<ffffffff810f5464>] run_timer_softirq+0x234/0x330
[296583.091982] [<ffffffff8108a339>] __do_softirq+0x109/0x2b0
Fixes: d4289fcc9b16 ("net: IP6 defrag: use rbtrees for IPv6 defrag")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Stefan Bader <stefan.bader@canonical.com>
Cc: Peter Oskolkov <posk@google.com>
Cc: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
110 lines
2.5 KiB
C
110 lines
2.5 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#ifndef _IPV6_FRAG_H
|
|
#define _IPV6_FRAG_H
|
|
#include <linux/kernel.h>
|
|
#include <net/addrconf.h>
|
|
#include <net/ipv6.h>
|
|
#include <net/inet_frag.h>
|
|
|
|
enum ip6_defrag_users {
|
|
IP6_DEFRAG_LOCAL_DELIVER,
|
|
IP6_DEFRAG_CONNTRACK_IN,
|
|
__IP6_DEFRAG_CONNTRACK_IN = IP6_DEFRAG_CONNTRACK_IN + USHRT_MAX,
|
|
IP6_DEFRAG_CONNTRACK_OUT,
|
|
__IP6_DEFRAG_CONNTRACK_OUT = IP6_DEFRAG_CONNTRACK_OUT + USHRT_MAX,
|
|
IP6_DEFRAG_CONNTRACK_BRIDGE_IN,
|
|
__IP6_DEFRAG_CONNTRACK_BRIDGE_IN = IP6_DEFRAG_CONNTRACK_BRIDGE_IN + USHRT_MAX,
|
|
};
|
|
|
|
/*
|
|
* Equivalent of ipv4 struct ip
|
|
*/
|
|
struct frag_queue {
|
|
struct inet_frag_queue q;
|
|
|
|
int iif;
|
|
__u16 nhoffset;
|
|
u8 ecn;
|
|
};
|
|
|
|
#if IS_ENABLED(CONFIG_IPV6)
|
|
static inline void ip6frag_init(struct inet_frag_queue *q, const void *a)
|
|
{
|
|
struct frag_queue *fq = container_of(q, struct frag_queue, q);
|
|
const struct frag_v6_compare_key *key = a;
|
|
|
|
q->key.v6 = *key;
|
|
fq->ecn = 0;
|
|
}
|
|
|
|
static inline u32 ip6frag_key_hashfn(const void *data, u32 len, u32 seed)
|
|
{
|
|
return jhash2(data,
|
|
sizeof(struct frag_v6_compare_key) / sizeof(u32), seed);
|
|
}
|
|
|
|
static inline u32 ip6frag_obj_hashfn(const void *data, u32 len, u32 seed)
|
|
{
|
|
const struct inet_frag_queue *fq = data;
|
|
|
|
return jhash2((const u32 *)&fq->key.v6,
|
|
sizeof(struct frag_v6_compare_key) / sizeof(u32), seed);
|
|
}
|
|
|
|
static inline int
|
|
ip6frag_obj_cmpfn(struct rhashtable_compare_arg *arg, const void *ptr)
|
|
{
|
|
const struct frag_v6_compare_key *key = arg->key;
|
|
const struct inet_frag_queue *fq = ptr;
|
|
|
|
return !!memcmp(&fq->key, key, sizeof(*key));
|
|
}
|
|
|
|
static inline void
|
|
ip6frag_expire_frag_queue(struct net *net, struct frag_queue *fq)
|
|
{
|
|
struct net_device *dev = NULL;
|
|
struct sk_buff *head;
|
|
|
|
rcu_read_lock();
|
|
spin_lock(&fq->q.lock);
|
|
|
|
if (fq->q.flags & INET_FRAG_COMPLETE)
|
|
goto out;
|
|
|
|
inet_frag_kill(&fq->q);
|
|
|
|
dev = dev_get_by_index_rcu(net, fq->iif);
|
|
if (!dev)
|
|
goto out;
|
|
|
|
__IP6_INC_STATS(net, __in6_dev_get(dev), IPSTATS_MIB_REASMFAILS);
|
|
__IP6_INC_STATS(net, __in6_dev_get(dev), IPSTATS_MIB_REASMTIMEOUT);
|
|
|
|
/* Don't send error if the first segment did not arrive. */
|
|
if (!(fq->q.flags & INET_FRAG_FIRST_IN))
|
|
goto out;
|
|
|
|
/* sk_buff::dev and sk_buff::rbnode are unionized. So we
|
|
* pull the head out of the tree in order to be able to
|
|
* deal with head->dev.
|
|
*/
|
|
head = inet_frag_pull_head(&fq->q);
|
|
if (!head)
|
|
goto out;
|
|
|
|
head->dev = dev;
|
|
spin_unlock(&fq->q.lock);
|
|
|
|
icmpv6_send(head, ICMPV6_TIME_EXCEED, ICMPV6_EXC_FRAGTIME, 0);
|
|
kfree_skb(head);
|
|
goto out_rcu_unlock;
|
|
|
|
out:
|
|
spin_unlock(&fq->q.lock);
|
|
out_rcu_unlock:
|
|
rcu_read_unlock();
|
|
inet_frag_put(&fq->q);
|
|
}
|
|
#endif
|
|
#endif
|