From: Vasily Averin <vvs@parallels•com>
To: Eric Dumazet <eric.dumazet@gmail•com>
Cc: netdev@vger•kernel.org, "David S. Miller" <davem@davemloft•net>,
Alexey Kuznetsov <kuznet@ms2•inr.ac.ru>,
James Morris <jmorris@namei•org>,
Hideaki YOSHIFUJI <yoshfuji@linux-ipv6•org>,
Patrick McHardy <kaber@trash•net>
Subject: Re: [PATCH v2] ipv4: dst_entry leak in ip_append_data()
Date: Wed, 15 Oct 2014 10:56:47 +0400 [thread overview]
Message-ID: <543E1AAF.9050601@parallels.com> (raw)
In-Reply-To: <1413348385.12304.0.camel@edumazet-glaptop2.roam.corp.google.com>
On 15.10.2014 08:46, Eric Dumazet wrote:
> On Tue, 2014-10-14 at 08:57 +0400, Vasily Averin wrote:
>> v2: adjust the indentation of the arguments __ip_append_data() call
>>
>> Fixes: 2e77d89b2fa8 ("net: avoid a pair of dst_hold()/dst_release() in ip_append_data()")
>>
>> If sk_write_queue is empty ip_append_data() executes ip_setup_cork()
>> that "steals" dst entry from rt to cork. Later it calls __ip_append_data()
>> that creates skb and adds it to sk_write_queue.
>>
>> If skb was added successfully following ip_push_pending_frames() call
>> reassign dst entries from cork to skb, and kfree_skb frees dst_entry.
>>
>> However nobody frees stolen dst_entry if skb was not added into sk_write_queue.
>
> I thought this was done by ip_flush_pending_frames() ?
Take look at ip_send_unicast_reply():
ip_flush_pending_frames() is not called if skb was not added to sk_write_queue.
And ip_rt_put() does not work, because dst entry was stolen in ip_setup_cork().
Probably it can happen in raw_sendmsg() and udp_sendmsg() too.
next prev parent reply other threads:[~2014-10-15 6:58 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-10-14 4:57 [PATCH v2] ipv4: dst_entry leak in ip_append_data() Vasily Averin
2014-10-14 20:12 ` David Miller
2014-10-15 7:48 ` Vasily Averin
2014-10-15 4:46 ` Eric Dumazet
2014-10-15 6:56 ` Vasily Averin [this message]
2014-10-15 9:30 ` Eric Dumazet
2014-10-15 11:31 ` Vasily Averin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=543E1AAF.9050601@parallels.com \
--to=vvs@parallels$(echo .)com \
--cc=davem@davemloft$(echo .)net \
--cc=eric.dumazet@gmail$(echo .)com \
--cc=jmorris@namei$(echo .)org \
--cc=kaber@trash$(echo .)net \
--cc=kuznet@ms2$(echo .)inr.ac.ru \
--cc=netdev@vger$(echo .)kernel.org \
--cc=yoshfuji@linux-ipv6$(echo .)org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox