From mboxrd@z Thu Jan 1 00:00:00 1970 From: Sabrina Dubroca Subject: Re: [PATCH 1/2] xfrm6: call kfree_skb when skb is toobig Date: Thu, 30 Aug 2018 15:23:11 +0200 Message-ID: <20180830132310.GA29881@bistromath.localdomain> References: <20180830125817.4567-1-cascardo@canonical.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Cc: netdev@vger.kernel.org, yoshfuji@linux-ipv6.org, kuznet@ms2.inr.ac.ru, davem@davemloft.net, herbert@gondor.apana.org.au, steffen.klassert@secunet.com, eyal.birger@gmail.com To: Thadeu Lima de Souza Cascardo Return-path: Received: from mx3-rdu2.redhat.com ([66.187.233.73]:55508 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1728702AbeH3RZG (ORCPT ); Thu, 30 Aug 2018 13:25:06 -0400 Content-Disposition: inline In-Reply-To: <20180830125817.4567-1-cascardo@canonical.com> Sender: netdev-owner@vger.kernel.org List-ID: 2018-08-30, 09:58:16 -0300, Thadeu Lima de Souza Cascardo wrote: > After commit d6990976af7c5d8f55903bfb4289b6fb030bf754 ("vti6: fix PMTU caching > and reporting on xmit"), some too big skbs might be potentially passed down to > __xfrm6_output, causing it to fail to transmit but not free the skb, causing a > leak of skb, and consequentially a leak of dst references. > > After running pmtu.sh, that shows as failure to unregister devices in a namespace: > > [ 311.397671] unregister_netdevice: waiting for veth_b to become free. Usage count = 1 > > The fix is to call kfree_skb in case of transmit failures. > > Signed-off-by: Thadeu Lima de Souza Cascardo Reviewed-by: Sabrina Dubroca I was about to post the same patch. Arguably, the commit introducing this bug is the one that added those "return -EMSGSIZE" to __xfrm6_output without freeing. Either way, it's missing a Fixes: tag, which should be one of those, or both: Fixes: d6990976af7c ("vti6: fix PMTU caching and reporting on xmit") Fixes: dd767856a36e ("xfrm6: Don't call icmpv6_send on local error") -- Sabrina