public-mirrors/linux
1
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-08-05 16:54:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

openvswitch: Fix skb leak in ovs_fragment()

Browse source 
If ovs_fragment() was unable to fragment the skb due to an L2 header
that exceeds the supported length, skbs would be leaked. Fix the bug.

Fixes: 7f8a436eaa "openvswitch: Add conntrack action"
Signed-off-by: Joe Stringer <joestringer@nicira.com>
Acked-by: Pravin B Shelar <pshelar@nicira.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Joe Stringer 2015-10-06 10:59:57 -07:00 • committed by David S. Miller
parent 0a7cc172a0
commit b8f2257069
1 changed files with 7 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
net/openvswitch/actions.c
View file

@ -684,7 +684,7 @@ static void ovs_fragment(struct vport *vport, struct sk_buff *skb, u16 mru,
{ {
if (skb_network_offset(skb) > MAX_L2_LEN) { if (skb_network_offset(skb) > MAX_L2_LEN) {
OVS_NLERR(1, "L2 header too long to fragment"); OVS_NLERR(1, "L2 header too long to fragment");
return; goto err;
} }
if (ethertype == htons(ETH_P_IP)) { if (ethertype == htons(ETH_P_IP)) {
@ -708,8 +708,7 @@ static void ovs_fragment(struct vport *vport, struct sk_buff *skb, u16 mru,
struct rt6_info ovs_rt; struct rt6_info ovs_rt;
if (!v6ops) { if (!v6ops) {
kfree_skb(skb); goto err;
return;
} }
prepare_frag(vport, skb); prepare_frag(vport, skb);
@ -728,8 +727,12 @@ static void ovs_fragment(struct vport *vport, struct sk_buff *skb, u16 mru,
WARN_ONCE(1, "Failed fragment ->%s: eth=%04x, MRU=%d, MTU=%d.", WARN_ONCE(1, "Failed fragment ->%s: eth=%04x, MRU=%d, MTU=%d.",
ovs_vport_name(vport), ntohs(ethertype), mru, ovs_vport_name(vport), ntohs(ethertype), mru,
vport->dev->mtu); vport->dev->mtu);
kfree_skb(skb); goto err;
} }
return;
err:
kfree_skb(skb);
} }
static void do_output(struct datapath *dp, struct sk_buff *skb, int out_port, static void do_output(struct datapath *dp, struct sk_buff *skb, int out_port,