From patchwork Thu Aug 30 12:58:16 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Thadeu Lima de Souza Cascardo X-Patchwork-Id: 963865 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=canonical.com Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 421MxN2kVcz9ryt for ; Thu, 30 Aug 2018 22:58:32 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728879AbeH3RAb (ORCPT ); Thu, 30 Aug 2018 13:00:31 -0400 Received: from youngberry.canonical.com ([91.189.89.112]:37486 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728638AbeH3RAb (ORCPT ); Thu, 30 Aug 2018 13:00:31 -0400 Received: from 1.general.cascardo.us.vpn ([10.172.70.58] helo=localhost.localdomain) by youngberry.canonical.com with esmtpsa (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.76) (envelope-from ) id 1fvMWo-0000vK-Qt; Thu, 30 Aug 2018 12:58:27 +0000 From: Thadeu Lima de Souza Cascardo To: netdev@vger.kernel.org Cc: yoshfuji@linux-ipv6.org, kuznet@ms2.inr.ac.ru, davem@davemloft.net, herbert@gondor.apana.org.au, steffen.klassert@secunet.com, eyal.birger@gmail.com Subject: [PATCH 1/2] xfrm6: call kfree_skb when skb is toobig Date: Thu, 30 Aug 2018 09:58:16 -0300 Message-Id: <20180830125817.4567-1-cascardo@canonical.com> X-Mailer: git-send-email 2.17.1 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org After commit d6990976af7c5d8f55903bfb4289b6fb030bf754 ("vti6: fix PMTU caching and reporting on xmit"), some too big skbs might be potentially passed down to __xfrm6_output, causing it to fail to transmit but not free the skb, causing a leak of skb, and consequentially a leak of dst references. After running pmtu.sh, that shows as failure to unregister devices in a namespace: [ 311.397671] unregister_netdevice: waiting for veth_b to become free. Usage count = 1 The fix is to call kfree_skb in case of transmit failures. Signed-off-by: Thadeu Lima de Souza Cascardo Reviewed-by: Sabrina Dubroca --- net/ipv6/xfrm6_output.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c index 5959ce9620eb..6a74080005cf 100644 --- a/net/ipv6/xfrm6_output.c +++ b/net/ipv6/xfrm6_output.c @@ -170,9 +170,11 @@ static int __xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb) if (toobig && xfrm6_local_dontfrag(skb)) { xfrm6_local_rxpmtu(skb, mtu); + kfree_skb(skb); return -EMSGSIZE; } else if (!skb->ignore_df && toobig && skb->sk) { xfrm_local_error(skb, mtu); + kfree_skb(skb); return -EMSGSIZE; } From patchwork Thu Aug 30 12:58:17 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Thadeu Lima de Souza Cascardo X-Patchwork-Id: 963866 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=canonical.com Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 421MxP6Pkmz9ryt for ; Thu, 30 Aug 2018 22:58:33 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728893AbeH3RAd (ORCPT ); Thu, 30 Aug 2018 13:00:33 -0400 Received: from youngberry.canonical.com ([91.189.89.112]:37491 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728638AbeH3RAd (ORCPT ); Thu, 30 Aug 2018 13:00:33 -0400 Received: from 1.general.cascardo.us.vpn ([10.172.70.58] helo=localhost.localdomain) by youngberry.canonical.com with esmtpsa (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.76) (envelope-from ) id 1fvMWs-0000vK-8E; Thu, 30 Aug 2018 12:58:30 +0000 From: Thadeu Lima de Souza Cascardo To: netdev@vger.kernel.org Cc: yoshfuji@linux-ipv6.org, kuznet@ms2.inr.ac.ru, davem@davemloft.net, herbert@gondor.apana.org.au, steffen.klassert@secunet.com, eyal.birger@gmail.com Subject: [PATCH 2/2] vti6: do not check for ignore_df in order to update pmtu Date: Thu, 30 Aug 2018 09:58:17 -0300 Message-Id: <20180830125817.4567-2-cascardo@canonical.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20180830125817.4567-1-cascardo@canonical.com> References: <20180830125817.4567-1-cascardo@canonical.com> Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Before commit d6990976af7c5d8f55903bfb4289b6fb030bf754 ("vti6: fix PMTU caching and reporting on xmit"), skb was scrubbed before checking for ignore_df. The scrubbing meant ignore_df was false, making the check irrelevant. Now that the scrubbing happens after that, some packets might fail the checking and dst will not have its pmtu updated. Not only that, but too big skb will be potentially passed down to __xfrm6_output, causing it to fail to transmit but not free the skb, causing a leak of skb, and consequentially a leak of dst references. After running pmtu.sh, that shows as failure to unregister devices in a namespace: [ 311.397671] unregister_netdevice: waiting for veth_b to become free. Usage count = 1 Signed-off-by: Thadeu Lima de Souza Cascardo --- net/ipv6/ip6_vti.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c index c72ae3a4fe09..fbd3752ea587 100644 --- a/net/ipv6/ip6_vti.c +++ b/net/ipv6/ip6_vti.c @@ -481,7 +481,7 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl) } mtu = dst_mtu(dst); - if (!skb->ignore_df && skb->len > mtu) { + if (skb->len > mtu) { skb_dst_update_pmtu(skb, mtu); if (skb->protocol == htons(ETH_P_IPV6)) {