Commit fb405883 authored by Peter Oskolkov's avatar Peter Oskolkov Committed by Alexei Starovoitov

bpf: fix memory leak in bpf_lwt_xmit_reroute

On error the skb should be freed. Tested with diff/steps
provided by David Ahern.

v2: surface routing errors to the user instead of a generic EINVAL,
    as suggested by David Ahern.
Reported-by: default avatarDavid Ahern <dsahern@gmail.com>
Fixes: 3bd0b152 ("bpf: add handling of BPF_LWT_REROUTE to lwt_bpf.c")
Signed-off-by: default avatarPeter Oskolkov <posk@google.com>
Reviewed-by: default avatarDavid Ahern <dsahern@gmail.com>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 87486b23
...@@ -179,17 +179,17 @@ static int bpf_lwt_xmit_reroute(struct sk_buff *skb) ...@@ -179,17 +179,17 @@ static int bpf_lwt_xmit_reroute(struct sk_buff *skb)
struct net_device *l3mdev = l3mdev_master_dev_rcu(skb_dst(skb)->dev); struct net_device *l3mdev = l3mdev_master_dev_rcu(skb_dst(skb)->dev);
int oif = l3mdev ? l3mdev->ifindex : 0; int oif = l3mdev ? l3mdev->ifindex : 0;
struct dst_entry *dst = NULL; struct dst_entry *dst = NULL;
int err = -EAFNOSUPPORT;
struct sock *sk; struct sock *sk;
struct net *net; struct net *net;
bool ipv4; bool ipv4;
int err;
if (skb->protocol == htons(ETH_P_IP)) if (skb->protocol == htons(ETH_P_IP))
ipv4 = true; ipv4 = true;
else if (skb->protocol == htons(ETH_P_IPV6)) else if (skb->protocol == htons(ETH_P_IPV6))
ipv4 = false; ipv4 = false;
else else
return -EAFNOSUPPORT; goto err;
sk = sk_to_full_sk(skb->sk); sk = sk_to_full_sk(skb->sk);
if (sk) { if (sk) {
...@@ -215,8 +215,10 @@ static int bpf_lwt_xmit_reroute(struct sk_buff *skb) ...@@ -215,8 +215,10 @@ static int bpf_lwt_xmit_reroute(struct sk_buff *skb)
fl4.saddr = iph->saddr; fl4.saddr = iph->saddr;
rt = ip_route_output_key(net, &fl4); rt = ip_route_output_key(net, &fl4);
if (IS_ERR(rt)) if (IS_ERR(rt)) {
return -EINVAL; err = PTR_ERR(rt);
goto err;
}
dst = &rt->dst; dst = &rt->dst;
} else { } else {
struct ipv6hdr *iph6 = ipv6_hdr(skb); struct ipv6hdr *iph6 = ipv6_hdr(skb);
...@@ -231,12 +233,17 @@ static int bpf_lwt_xmit_reroute(struct sk_buff *skb) ...@@ -231,12 +233,17 @@ static int bpf_lwt_xmit_reroute(struct sk_buff *skb)
fl6.saddr = iph6->saddr; fl6.saddr = iph6->saddr;
err = ipv6_stub->ipv6_dst_lookup(net, skb->sk, &dst, &fl6); err = ipv6_stub->ipv6_dst_lookup(net, skb->sk, &dst, &fl6);
if (err || IS_ERR(dst)) if (unlikely(err))
return -EINVAL; goto err;
if (IS_ERR(dst)) {
err = PTR_ERR(dst);
goto err;
}
} }
if (unlikely(dst->error)) { if (unlikely(dst->error)) {
err = dst->error;
dst_release(dst); dst_release(dst);
return -EINVAL; goto err;
} }
/* Although skb header was reserved in bpf_lwt_push_ip_encap(), it /* Although skb header was reserved in bpf_lwt_push_ip_encap(), it
...@@ -246,17 +253,21 @@ static int bpf_lwt_xmit_reroute(struct sk_buff *skb) ...@@ -246,17 +253,21 @@ static int bpf_lwt_xmit_reroute(struct sk_buff *skb)
*/ */
err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev)); err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev));
if (unlikely(err)) if (unlikely(err))
return err; goto err;
skb_dst_drop(skb); skb_dst_drop(skb);
skb_dst_set(skb, dst); skb_dst_set(skb, dst);
err = dst_output(dev_net(skb_dst(skb)->dev), skb->sk, skb); err = dst_output(dev_net(skb_dst(skb)->dev), skb->sk, skb);
if (unlikely(err)) if (unlikely(err))
return err; goto err;
/* ip[6]_finish_output2 understand LWTUNNEL_XMIT_DONE */ /* ip[6]_finish_output2 understand LWTUNNEL_XMIT_DONE */
return LWTUNNEL_XMIT_DONE; return LWTUNNEL_XMIT_DONE;
err:
kfree_skb(skb);
return err;
} }
static int bpf_xmit(struct sk_buff *skb) static int bpf_xmit(struct sk_buff *skb)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment