ipvlan: fix leak in ipvlan_rcv_frame
Pass a **skb to ipvlan_rcv_frame so that if skb_share_check returns a
new skb, we actually use it during further processing.
It's safe to ignore the new skb in the ipvlan_xmit_* functions, because
they call ipvlan_rcv_frame with local == true, so that dev_forward_skb
is called and always takes ownership of the skb.
Fixes: 2ad7bf3638
("ipvlan: Initial check-in of the IPVLAN driver.")
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
eb3f8b42aa
commit
cf554ada0b
|
@ -254,7 +254,7 @@ acct:
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
static int ipvlan_rcv_frame(struct ipvl_addr *addr, struct sk_buff *skb,
|
static int ipvlan_rcv_frame(struct ipvl_addr *addr, struct sk_buff **pskb,
|
||||||
bool local)
|
bool local)
|
||||||
{
|
{
|
||||||
struct ipvl_dev *ipvlan = addr->master;
|
struct ipvl_dev *ipvlan = addr->master;
|
||||||
|
@ -262,6 +262,7 @@ static int ipvlan_rcv_frame(struct ipvl_addr *addr, struct sk_buff *skb,
|
||||||
unsigned int len;
|
unsigned int len;
|
||||||
rx_handler_result_t ret = RX_HANDLER_CONSUMED;
|
rx_handler_result_t ret = RX_HANDLER_CONSUMED;
|
||||||
bool success = false;
|
bool success = false;
|
||||||
|
struct sk_buff *skb = *pskb;
|
||||||
|
|
||||||
len = skb->len + ETH_HLEN;
|
len = skb->len + ETH_HLEN;
|
||||||
if (unlikely(!(dev->flags & IFF_UP))) {
|
if (unlikely(!(dev->flags & IFF_UP))) {
|
||||||
|
@ -273,6 +274,7 @@ static int ipvlan_rcv_frame(struct ipvl_addr *addr, struct sk_buff *skb,
|
||||||
if (!skb)
|
if (!skb)
|
||||||
goto out;
|
goto out;
|
||||||
|
|
||||||
|
*pskb = skb;
|
||||||
skb->dev = dev;
|
skb->dev = dev;
|
||||||
skb->pkt_type = PACKET_HOST;
|
skb->pkt_type = PACKET_HOST;
|
||||||
|
|
||||||
|
@ -486,7 +488,7 @@ static int ipvlan_xmit_mode_l3(struct sk_buff *skb, struct net_device *dev)
|
||||||
|
|
||||||
addr = ipvlan_addr_lookup(ipvlan->port, lyr3h, addr_type, true);
|
addr = ipvlan_addr_lookup(ipvlan->port, lyr3h, addr_type, true);
|
||||||
if (addr)
|
if (addr)
|
||||||
return ipvlan_rcv_frame(addr, skb, true);
|
return ipvlan_rcv_frame(addr, &skb, true);
|
||||||
|
|
||||||
out:
|
out:
|
||||||
skb->dev = ipvlan->phy_dev;
|
skb->dev = ipvlan->phy_dev;
|
||||||
|
@ -506,7 +508,7 @@ static int ipvlan_xmit_mode_l2(struct sk_buff *skb, struct net_device *dev)
|
||||||
if (lyr3h) {
|
if (lyr3h) {
|
||||||
addr = ipvlan_addr_lookup(ipvlan->port, lyr3h, addr_type, true);
|
addr = ipvlan_addr_lookup(ipvlan->port, lyr3h, addr_type, true);
|
||||||
if (addr)
|
if (addr)
|
||||||
return ipvlan_rcv_frame(addr, skb, true);
|
return ipvlan_rcv_frame(addr, &skb, true);
|
||||||
}
|
}
|
||||||
skb = skb_share_check(skb, GFP_ATOMIC);
|
skb = skb_share_check(skb, GFP_ATOMIC);
|
||||||
if (!skb)
|
if (!skb)
|
||||||
|
@ -589,7 +591,7 @@ static rx_handler_result_t ipvlan_handle_mode_l3(struct sk_buff **pskb,
|
||||||
|
|
||||||
addr = ipvlan_addr_lookup(port, lyr3h, addr_type, true);
|
addr = ipvlan_addr_lookup(port, lyr3h, addr_type, true);
|
||||||
if (addr)
|
if (addr)
|
||||||
ret = ipvlan_rcv_frame(addr, skb, false);
|
ret = ipvlan_rcv_frame(addr, pskb, false);
|
||||||
|
|
||||||
out:
|
out:
|
||||||
return ret;
|
return ret;
|
||||||
|
@ -626,7 +628,7 @@ static rx_handler_result_t ipvlan_handle_mode_l2(struct sk_buff **pskb,
|
||||||
|
|
||||||
addr = ipvlan_addr_lookup(port, lyr3h, addr_type, true);
|
addr = ipvlan_addr_lookup(port, lyr3h, addr_type, true);
|
||||||
if (addr)
|
if (addr)
|
||||||
ret = ipvlan_rcv_frame(addr, skb, false);
|
ret = ipvlan_rcv_frame(addr, pskb, false);
|
||||||
}
|
}
|
||||||
|
|
||||||
return ret;
|
return ret;
|
||||||
|
|
Loading…
Reference in a new issue