Re: [PATCH net] xfrm: iptfs: fix skb leak on error in __input_process_payload()

[Steffen Klassert <steffen.klassert@secunet.com>]

On Tue, Nov 03, 2026 at 09:45:28AM +0100, Paolo Abeni wrote:
> On 10/30/26 09:33, Eric Dumazet wrote:
> > syzbot reported a memory leak of the received skb (and its sec_path
> > extension) in the IP-TFS receive path.
> > 
> > __input_process_payload() parses the inner packets of an IP-TFS payload
> > and queues them on @sublist, which is only sent after the parsing loop.
> > Three error paths inside the loop (skb_copy_seq_read() failure, invalid
> > inner IPv4 header length, unknown IP version) jump to the "done" label,
> > which is placed after the code sending @sublist.
> > 
> > Any skb already queued on @sublist is then neither delivered nor freed.
> > This includes skbs added by iptfs_reassem_cont() before the call, newly
> > allocated inner packets, and, since the received skb can be reused for
> > the first inner packet, the received skb itself.
> > 
> > Move the "done" label before the trim/send code, so that inner packets
> > parsed before the error are delivered as on the normal exit path. The
> > received skb is then still freed (or consumed) as before when it was
> > not reused.
> > 
> > Fixes: 6c82d2433671 ("xfrm: iptfs: add basic receive packet (tunnel egress) handling")
> > Reported-by: syzbot+a3f21220cbbb6e14ee2e@syzkaller.appspotmail.com
> > Closes: https://lore.kernel.org/netdev/6ae4102e.9c6421ad.36baac.0005.GAE@google.com/
> > Signed-off-by: Eric Dumazet <edumazet@kernel.org>
> > ---
> > Cc: Steffen Klassert <steffen.klassert@secunet.com>
> > Cc: Herbert Xu <herbert@gondor.apana.org.au>
> 
> @Steffen, do you prefer to take this one via your tree? Otherwise, would you mind
> acking it?

I have a pending pull request for the ipsec tree, my plan
was to apply it once the PR is merged. But since the
ipsec tree is empty after the PR is merge, I could
also ack it if you prefer that.

Steffen