diff options
author | David S. Miller <davem@davemloft.net> | 2022-02-09 14:41:48 +0300 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2022-02-09 14:41:48 +0300 |
commit | 676b49366a70ea91997585ba8e4577290f5172a5 (patch) | |
tree | 5ddb6e2fe01cc4820bc36c63dc3383c698dfd708 /net/ax25 | |
parent | 7db788ad627aabff2b74d4f1a3b68516d0fee0d7 (diff) | |
parent | 9eeabdf17fa0ab75381045c867c370f4cc75a613 (diff) |
Merge branch 'net-fix-skb-unclone-issues'
Antoine Tenart says:
====================
net: fix issues when uncloning an skb dst+metadata
This fixes two issues when uncloning an skb dst+metadata in
tun_dst_unclone; this was initially reported by Vlad Buslov[1]. Because
of the memory leak fixed by patch 2, the issue in patch 1 never happened
in practice.
tun_dst_unclone is called from two different places, one in geneve/vxlan
to handle PMTU and one in net/openvswitch/actions.c where it is used to
retrieve tunnel information. While both Vlad and I tested the former, we
could not for the latter. I did spend quite some time trying to, but
that code path is not easy to trigger. Code inspection shows this should
be fine, the tunnel information (dst+metadata) is uncloned and the skb
it is referenced from is only consumed after all accesses to the tunnel
information are done:
do_execute_actions
output_userspace
dev_fill_metadata_dst <- dst+metadata is uncloned
ovs_dp_upcall
queue_userspace_packet
ovs_nla_put_tunnel_info <- metadata (tunnel info) is accessed
consume_skb <- dst+metadata is freed
Thanks!
Antoine
[1] https://lore.kernel.org/all/ygnhh79yluw2.fsf@nvidia.com/T/#m2f814614a4f5424cea66bbff7297f692b59b69a0
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ax25')
0 files changed, 0 insertions, 0 deletions