Commit 97599dc7 authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller

net: drop dst before queueing fragments

Commit 4a94445c (net: Use ip_route_input_noref() in input path)
added a bug in IP defragmentation handling, as non refcounted
dst could escape an RCU protected section.

Commit 64f3b9e2 (net: ip_expire() must revalidate route) fixed
the case of timeouts, but not the general problem.

Tom Parkin noticed crashes in UDP stack and provided a patch,
but further analysis permitted us to pinpoint the root cause.

Before queueing a packet into a frag list, we must drop its dst,
as this dst has limited lifetime (RCU protected)

When/if a packet is finally reassembled, we use the dst of the very
last skb, still protected by RCU and valid, as the dst of the
reassembled packet.

Use same logic in IPv6, as there is no need to hold dst references.
Reported-by: default avatarTom Parkin <tparkin@katalix.com>
Tested-by: default avatarTom Parkin <tparkin@katalix.com>
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 8d7ed0f0
...@@ -248,8 +248,7 @@ static void ip_expire(unsigned long arg) ...@@ -248,8 +248,7 @@ static void ip_expire(unsigned long arg)
if (!head->dev) if (!head->dev)
goto out_rcu_unlock; goto out_rcu_unlock;
/* skb dst is stale, drop it, and perform route lookup again */ /* skb has no dst, perform route lookup again */
skb_dst_drop(head);
iph = ip_hdr(head); iph = ip_hdr(head);
err = ip_route_input_noref(head, iph->daddr, iph->saddr, err = ip_route_input_noref(head, iph->daddr, iph->saddr,
iph->tos, head->dev); iph->tos, head->dev);
...@@ -523,9 +522,16 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb) ...@@ -523,9 +522,16 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
qp->q.max_size = skb->len + ihl; qp->q.max_size = skb->len + ihl;
if (qp->q.last_in == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) && if (qp->q.last_in == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&
qp->q.meat == qp->q.len) qp->q.meat == qp->q.len) {
return ip_frag_reasm(qp, prev, dev); unsigned long orefdst = skb->_skb_refdst;
skb->_skb_refdst = 0UL;
err = ip_frag_reasm(qp, prev, dev);
skb->_skb_refdst = orefdst;
return err;
}
skb_dst_drop(skb);
inet_frag_lru_move(&qp->q); inet_frag_lru_move(&qp->q);
return -EINPROGRESS; return -EINPROGRESS;
......
...@@ -330,9 +330,17 @@ static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb, ...@@ -330,9 +330,17 @@ static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
} }
if (fq->q.last_in == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) && if (fq->q.last_in == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&
fq->q.meat == fq->q.len) fq->q.meat == fq->q.len) {
return ip6_frag_reasm(fq, prev, dev); int res;
unsigned long orefdst = skb->_skb_refdst;
skb->_skb_refdst = 0UL;
res = ip6_frag_reasm(fq, prev, dev);
skb->_skb_refdst = orefdst;
return res;
}
skb_dst_drop(skb);
inet_frag_lru_move(&fq->q); inet_frag_lru_move(&fq->q);
return -1; return -1;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment