[PATCH 2.6.20-rc5] IPV6: skb is unexpectedly freed.

[PATCH 2.6.20-rc5] IPV6: skb is unexpectedly freed.

[Masayuki Nakagawa]

I encountered a kernel panic with my test program, which is a very simple
IPv6 client-server program.
The server side sets IPV6_RECVPKTINFO on a listening socket,
and the client side just sends a message to the server.
Then the kernel panic occurs on the server.
(If you need the test program, please let me know. I can provide it.)

This problem happens because a skb is forcibly freed in
tcp_rcv_state_process().
When a socket in listening state(TCP_LISTEN) receives a syn packet,
then tcp_v6_conn_request() will be called from tcp_rcv_state_process().
If the tcp_v6_conn_request() successfully returns, the skb would be discarded
by __kfree_skb().
However, in case of a listening socket which was already set IPV6_RECVPKTINFO,
an address of the skb will be stored in treq->pktopts and a ref count of the skb
will be incremented in tcp_v6_conn_request().
But, even if the skb is still in use, the skb will be freed.
Then someone still using the freed skb will cause the kernel panic.

I suggest to use kfree_skb() instead of __kfree_skb().

Signed-off-by: Masayuki Nakagawa <nakagawa.msy@ncos.nec.co.jp>

---
--- linux-2.6/net/ipv4/tcp_input.c.orig	2007-01-17 13:25:10.000000000 -0800
+++ linux-2.6/net/ipv4/tcp_input.c	2007-01-17 13:28:48.000000000 -0800
@@ -4420,9 +4420,11 @@ int tcp_rcv_state_process(struct sock *s
 			 * But, this leaves one open to an easy denial of
 		 	 * service attack, and SYN cookies can't defend
 			 * against this problem. So, we drop the data
-			 * in the interest of security over speed.
+			 * in the interest of security over speed unless
+			 * it's still in use.
 			 */
-			goto discard;
+			kfree_skb(skb);
+			return 0;
 		}
 		goto discard;

Re: [PATCH 2.6.20-rc5] IPV6: skb is unexpectedly freed.

[Herbert Xu]

Masayuki Nakagawa <nakagawa.msy@ncos.nec.co.jp> wrote:
> 
> I suggest to use kfree_skb() instead of __kfree_skb().

I agree.  In fact please do it for all paths in that function, i.e.,
just change __kfree_skb to kfree_skb rather than adding a special case
for this path.

Thanks,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: [PATCH 2.6.20-rc5] IPV6: skb is unexpectedly freed.

[YOSHIFUJI Hideaki / 吉藤英明]

In article <E1H9ZnX-0001z5-00@gondolin.me.apana.org.au> (at Wed, 24 Jan 2007 15:31:47 +1100), Herbert Xu <herbert@gondor.apana.org.au> says:

> Masayuki Nakagawa <nakagawa.msy@ncos.nec.co.jp> wrote:
> > 
> > I suggest to use kfree_skb() instead of __kfree_skb().
> 
> I agree.  In fact please do it for all paths in that function, i.e.,
> just change __kfree_skb to kfree_skb rather than adding a special case
> for this path.

I do think so, too.

--yoshfuji

Re: [PATCH 2.6.20-rc5] IPV6: skb is unexpectedly freed.

[David Miller]

From: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Date: Wed, 24 Jan 2007 13:37:25 +0900 (JST)

> In article <E1H9ZnX-0001z5-00@gondolin.me.apana.org.au> (at Wed, 24 Jan 2007 15:31:47 +1100), Herbert Xu <herbert@gondor.apana.org.au> says:
> 
> > Masayuki Nakagawa <nakagawa.msy@ncos.nec.co.jp> wrote:
> > > 
> > > I suggest to use kfree_skb() instead of __kfree_skb().
> > 
> > I agree.  In fact please do it for all paths in that function, i.e.,
> > just change __kfree_skb to kfree_skb rather than adding a special case
> > for this path.
> 
> I do think so, too.

So do I, but initially I want to push his basic patch in
so that I can push the same exact thing into -stable to
fix this bug.

So if you make the subsequent change, please make it relative
to the original patch.

Thank you.

Re: [PATCH 2.6.20-rc5] IPV6: skb is unexpectedly freed.

[Masayuki Nakagawa]

David, Yoshifuji-san, Herbert,

I appreciate your feedback.

I made an another patch that simply replaced __kfree_skb() in exit path with
kfree_skb(). I tested it overnight with a chat benchmark tool and
my test program, which can reproduce the original problem.

As a result, I didn't see any problem.
(For example, neither oops nor memory leak happened.)

I will post the patch a few moments later. Please take a look at it.

Thanks,
Masa

David Miller wrote:
> From: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
> Date: Wed, 24 Jan 2007 13:37:25 +0900 (JST)
>
>   
>> In article <E1H9ZnX-0001z5-00@gondolin.me.apana.org.au> (at Wed, 24 Jan 2007 15:31:47 +1100), Herbert Xu <herbert@gondor.apana.org.au> says:
>>
>>     
>>> Masayuki Nakagawa <nakagawa.msy@ncos.nec.co.jp> wrote:
>>>       
>>>> I suggest to use kfree_skb() instead of __kfree_skb().
>>>>         
>>> I agree.  In fact please do it for all paths in that function, i.e.,
>>> just change __kfree_skb to kfree_skb rather than adding a special case
>>> for this path.
>>>       
>> I do think so, too.
>>     
>
> So do I, but initially I want to push his basic patch in
> so that I can push the same exact thing into -stable to
> fix this bug.
>
> So if you make the subsequent change, please make it relative
> to the original patch.
>
> Thank you.
> -
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>
>