From mboxrd@z Thu Jan 1 00:00:00 1970 From: Vasily Averin Subject: Re: [PATCH v2] ipv4: dst_entry leak in ip_append_data() Date: Wed, 15 Oct 2014 10:56:47 +0400 Message-ID: <543E1AAF.9050601@parallels.com> References: <543CAD2A.3070701@parallels.com> <1413348385.12304.0.camel@edumazet-glaptop2.roam.corp.google.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Cc: netdev@vger.kernel.org, "David S. Miller" , Alexey Kuznetsov , James Morris , Hideaki YOSHIFUJI , Patrick McHardy To: Eric Dumazet Return-path: Received: from mailhub.sw.ru ([195.214.232.25]:28960 "EHLO relay.sw.ru" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750775AbaJOG62 (ORCPT ); Wed, 15 Oct 2014 02:58:28 -0400 In-Reply-To: <1413348385.12304.0.camel@edumazet-glaptop2.roam.corp.google.com> Sender: netdev-owner@vger.kernel.org List-ID: On 15.10.2014 08:46, Eric Dumazet wrote: > On Tue, 2014-10-14 at 08:57 +0400, Vasily Averin wrote: >> v2: adjust the indentation of the arguments __ip_append_data() call >> >> Fixes: 2e77d89b2fa8 ("net: avoid a pair of dst_hold()/dst_release() in ip_append_data()") >> >> If sk_write_queue is empty ip_append_data() executes ip_setup_cork() >> that "steals" dst entry from rt to cork. Later it calls __ip_append_data() >> that creates skb and adds it to sk_write_queue. >> >> If skb was added successfully following ip_push_pending_frames() call >> reassign dst entries from cork to skb, and kfree_skb frees dst_entry. >> >> However nobody frees stolen dst_entry if skb was not added into sk_write_queue. > > I thought this was done by ip_flush_pending_frames() ? Take look at ip_send_unicast_reply(): ip_flush_pending_frames() is not called if skb was not added to sk_write_queue. And ip_rt_put() does not work, because dst entry was stolen in ip_setup_cork(). Probably it can happen in raw_sendmsg() and udp_sendmsg() too.