From patchwork Wed Apr 1 16:18:13 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 228342 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 211EDC2BA12 for ; Wed, 1 Apr 2020 16:51:08 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id CC7F4206E9 for ; Wed, 1 Apr 2020 16:51:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759867; bh=vHUjieBU5aslM55rEOP09v3yMqm7chbEbPX1sJ1IF44=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=VAaErQJ8kklvbFuvvBBg+SsMmtNCVYFE0/iK/nnHYXZJ3CVb+RcNzhX+HWenr/STK cv3gj6i1WOZD0T5l4N6Ron0vw5SVYQUuUcLMBtW2cd9h+1Y2Qd1QpBe6iqiz4TqdKF 50pyYEx7L/+VLmYknx4d1++oJ+IECGeLksATKOA4= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389049AbgDAQiC (ORCPT ); Wed, 1 Apr 2020 12:38:02 -0400 Received: from mail.kernel.org ([198.145.29.99]:37460 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388751AbgDAQiB (ORCPT ); Wed, 1 Apr 2020 12:38:01 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 6C587206F8; Wed, 1 Apr 2020 16:38:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759080; bh=vHUjieBU5aslM55rEOP09v3yMqm7chbEbPX1sJ1IF44=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Gpg2W2U5QDv1NuUBUYQzxIWJ0eMemTzvBlJWtErVfTAFcUgItZ8G4NkscwuUSeLBh PQ4cmdkpmZD3joqu738GU/6d2L9t3t6SoVe0+3VnU0d8tfr9Wz9GT3z2h14FPdUe5F IsOoLuVwDC9NVAkKakBU/pMYjUyRnXEVUgZo1zKY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Torsten Hilbrich , Nicolas Dichtel , Steffen Klassert Subject: [PATCH 4.9 070/102] vti6: Fix memory leak of skb if input policy check fails Date: Wed, 1 Apr 2020 18:18:13 +0200 Message-Id: <20200401161544.369456064@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Torsten Hilbrich commit 2a9de3af21aa8c31cd68b0b39330d69f8c1e59df upstream. The vti6_rcv function performs some tests on the retrieved tunnel including checking the IP protocol, the XFRM input policy, the source and destination address. In all but one places the skb is released in the error case. When the input policy check fails the network packet is leaked. Using the same goto-label discard in this case to fix this problem. Fixes: ed1efb2aefbb ("ipv6: Add support for IPsec virtual tunnel interfaces") Signed-off-by: Torsten Hilbrich Reviewed-by: Nicolas Dichtel Signed-off-by: Steffen Klassert Signed-off-by: Greg Kroah-Hartman --- net/ipv6/ip6_vti.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/ipv6/ip6_vti.c +++ b/net/ipv6/ip6_vti.c @@ -315,7 +315,7 @@ static int vti6_rcv(struct sk_buff *skb) if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) { rcu_read_unlock(); - return 0; + goto discard; } ipv6h = ipv6_hdr(skb);