On Thu, Aug 30, 2018 at 03:23:11PM +0200, Sabrina Dubroca wrote:
> 2018-08-30, 09:58:16 -0300, Thadeu Lima de Souza Cascardo wrote:
> > After commit d6990976af7c5d8f55903bfb4289b6fb030bf754 ("vti6: fix PMTU
> > caching
> > and reporting on xmit"), some too big skbs might be potentially passed down
> > to
> > __xfrm6_output, causing it to fail to transmit but not free the skb,
> > causing a
> > leak of skb, and consequentially a leak of dst references.
> >
> > After running pmtu.sh, that shows as failure to unregister devices in a
> > namespace:
> >
> > [ 311.397671] unregister_netdevice: waiting for veth_b to become free.
> > Usage count = 1
> >
> > The fix is to call kfree_skb in case of transmit failures.
> >
> > Signed-off-by: Thadeu Lima de Souza Cascardo <casca...@canonical.com>
Good catch!
> Reviewed-by: Sabrina Dubroca <s...@queasysnail.net>
>
> I was about to post the same patch. Arguably, the commit introducing
> this bug is the one that added those "return -EMSGSIZE" to
> __xfrm6_output without freeing.
>
> Either way, it's missing a Fixes: tag, which should be one of those,
> or both:
>
> Fixes: d6990976af7c ("vti6: fix PMTU caching and reporting on xmit")
> Fixes: dd767856a36e ("xfrm6: Don't call icmpv6_send on local error")
This bug can be triggered even without vti6, so the correct
Fixes tag would be the latter.
Thadeu, please resend this one with the Fixes tag.
Thanks!
