Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cf554ada authored by Sabrina Dubroca's avatar Sabrina Dubroca Committed by David S. Miller
Browse files

ipvlan: fix leak in ipvlan_rcv_frame 



Pass a **skb to ipvlan_rcv_frame so that if skb_share_check returns a
new skb, we actually use it during further processing.

It's safe to ignore the new skb in the ipvlan_xmit_* functions, because
they call ipvlan_rcv_frame with local == true, so that dev_forward_skb
is called and always takes ownership of the skb.

Fixes: 2ad7bf36 ("ipvlan: Initial check-in of the IPVLAN driver.")
Signed-off-by: default avatarSabrina Dubroca <sd@queasysnail.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent eb3f8b42

drivers/net/ipvlan/ipvlan_core.c

+7 −5
Original line number Diff line number Diff line
@@ -254,7 +254,7 @@ void ipvlan_process_multicast(struct work_struct *work) 
	}

}



static int ipvlan_rcv_frame(struct ipvl_addr *addr, struct sk_buff *skb,

static int ipvlan_rcv_frame(struct ipvl_addr *addr, struct sk_buff **pskb,

			    bool local)

{

	struct ipvl_dev *ipvlan = addr->master;
@@ -262,6 +262,7 @@ static int ipvlan_rcv_frame(struct ipvl_addr *addr, struct sk_buff *skb, 
	unsigned int len;

	rx_handler_result_t ret = RX_HANDLER_CONSUMED;

	bool success = false;

	struct sk_buff *skb = *pskb;



	len = skb->len + ETH_HLEN;

	if (unlikely(!(dev->flags & IFF_UP))) {
@@ -273,6 +274,7 @@ static int ipvlan_rcv_frame(struct ipvl_addr *addr, struct sk_buff *skb, 
	if (!skb)

		goto out;



	*pskb = skb;

	skb->dev = dev;

	skb->pkt_type = PACKET_HOST;
@@ -486,7 +488,7 @@ static int ipvlan_xmit_mode_l3(struct sk_buff *skb, struct net_device *dev) 


	addr = ipvlan_addr_lookup(ipvlan->port, lyr3h, addr_type, true);

	if (addr)

		return ipvlan_rcv_frame(addr, skb, true);

		return ipvlan_rcv_frame(addr, &skb, true);



out:

	skb->dev = ipvlan->phy_dev;
@@ -506,7 +508,7 @@ static int ipvlan_xmit_mode_l2(struct sk_buff *skb, struct net_device *dev) 
		if (lyr3h) {

			addr = ipvlan_addr_lookup(ipvlan->port, lyr3h, addr_type, true);

			if (addr)

				return ipvlan_rcv_frame(addr, skb, true);

				return ipvlan_rcv_frame(addr, &skb, true);

		}

		skb = skb_share_check(skb, GFP_ATOMIC);

		if (!skb)
@@ -589,7 +591,7 @@ static rx_handler_result_t ipvlan_handle_mode_l3(struct sk_buff **pskb, 


	addr = ipvlan_addr_lookup(port, lyr3h, addr_type, true);

	if (addr)

		ret = ipvlan_rcv_frame(addr, skb, false);

		ret = ipvlan_rcv_frame(addr, pskb, false);



out:

	return ret;
@@ -626,7 +628,7 @@ static rx_handler_result_t ipvlan_handle_mode_l2(struct sk_buff **pskb, 


		addr = ipvlan_addr_lookup(port, lyr3h, addr_type, true);

		if (addr)

			ret = ipvlan_rcv_frame(addr, skb, false);

			ret = ipvlan_rcv_frame(addr, pskb, false);

	}



	return ret;