Commit 53374b5a authored by Guillaume Nault's avatar Guillaume Nault Committed by Greg Kroah-Hartman

netfilter: ipv6: nf_defrag: fix leakage of unqueued fragments

[ Upstream commit a0d56cb9 ]

With commit 997dd964 ("net: IP6 defrag: use rbtrees in
nf_conntrack_reasm.c"), nf_ct_frag6_reasm() is now called from
nf_ct_frag6_queue(). With this change, nf_ct_frag6_queue() can fail
after the skb has been added to the fragment queue and
nf_ct_frag6_gather() was adapted to handle this case.

But nf_ct_frag6_queue() can still fail before the fragment has been
queued. nf_ct_frag6_gather() can't handle this case anymore, because it
has no way to know if nf_ct_frag6_queue() queued the fragment before
failing. If it didn't, the skb is lost as the error code is overwritten
with -EINPROGRESS.

Fix this by setting -EINPROGRESS directly in nf_ct_frag6_queue(), so
that nf_ct_frag6_gather() can propagate the error as is.

Fixes: 997dd964 ("net: IP6 defrag: use rbtrees in nf_conntrack_reasm.c")
Signed-off-by: default avatarGuillaume Nault <gnault@redhat.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent e9111176
...@@ -293,7 +293,11 @@ static int nf_ct_frag6_queue(struct frag_queue *fq, struct sk_buff *skb, ...@@ -293,7 +293,11 @@ static int nf_ct_frag6_queue(struct frag_queue *fq, struct sk_buff *skb,
skb->_skb_refdst = 0UL; skb->_skb_refdst = 0UL;
err = nf_ct_frag6_reasm(fq, skb, prev, dev); err = nf_ct_frag6_reasm(fq, skb, prev, dev);
skb->_skb_refdst = orefdst; skb->_skb_refdst = orefdst;
return err;
/* After queue has assumed skb ownership, only 0 or
* -EINPROGRESS must be returned.
*/
return err ? -EINPROGRESS : 0;
} }
skb_dst_drop(skb); skb_dst_drop(skb);
...@@ -480,12 +484,6 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user) ...@@ -480,12 +484,6 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user)
ret = 0; ret = 0;
} }
/* after queue has assumed skb ownership, only 0 or -EINPROGRESS
* must be returned.
*/
if (ret)
ret = -EINPROGRESS;
spin_unlock_bh(&fq->q.lock); spin_unlock_bh(&fq->q.lock);
inet_frag_put(&fq->q); inet_frag_put(&fq->q);
return ret; return ret;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment