[PATCH net] xfrm: iptfs: fix skb leak on error in __input_process_payload()

[PATCH net] xfrm: iptfs: fix skb leak on error in __input_process_payload()

[Eric Dumazet]

syzbot reported a memory leak of the received skb (and its sec_path
extension) in the IP-TFS receive path.

__input_process_payload() parses the inner packets of an IP-TFS payload
and queues them on @sublist, which is only sent after the parsing loop.
Three error paths inside the loop (skb_copy_seq_read() failure, invalid
inner IPv4 header length, unknown IP version) jump to the "done" label,
which is placed after the code sending @sublist.

Any skb already queued on @sublist is then neither delivered nor freed.
This includes skbs added by iptfs_reassem_cont() before the call, newly
allocated inner packets, and, since the received skb can be reused for
the first inner packet, the received skb itself.

Move the "done" label before the trim/send code, so that inner packets
parsed before the error are delivered as on the normal exit path. The
received skb is then still freed (or consumed) as before when it was
not reused.

Fixes: 6c82d2433671 ("xfrm: iptfs: add basic receive packet (tunnel egress) handling")
Reported-by: syzbot+a3f21220cbbb6e14ee2e@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6ae4102e.9c6421ad.36baac.0005.GAE@google.com/
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
---
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
---
 net/xfrm/xfrm_iptfs.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/xfrm/xfrm_iptfs.c b/net/xfrm/xfrm_iptfs.c
index 103cf7c5dbfb..0313a43aa8a9 100644
--- a/net/xfrm/xfrm_iptfs.c
+++ b/net/xfrm/xfrm_iptfs.c
@@ -1182,6 +1182,7 @@ static bool __input_process_payload(struct xfrm_state *x, u32 data,
 		/* this should not happen from the above code */
 		XFRM_INC_STATS(net, LINUX_MIB_XFRMINIPTFSERROR);
 
+done:
 	if (first_skb && first_iplen && !defer && !first_skb_partial) {
 		/* first_skb is queued b/c !defer and not partial */
 		if (pskb_trim(first_skb, first_iplen)) {
@@ -1198,7 +1199,7 @@ static bool __input_process_payload(struct xfrm_state *x, u32 data,
 		if (xfrm_input(skb, 0, 0, -2))
 			kfree_skb(skb);
 	}
-done:
+
 	skb = skbseq->root_skb;
 	skb_abort_seq_read(skbseq);
 
-- 
2.53.0

Re: [PATCH net] xfrm: iptfs: fix skb leak on error in __input_process_payload()

[Paolo Abeni]

On 10/30/26 09:33, Eric Dumazet wrote:
> syzbot reported a memory leak of the received skb (and its sec_path
> extension) in the IP-TFS receive path.
> 
> __input_process_payload() parses the inner packets of an IP-TFS payload
> and queues them on @sublist, which is only sent after the parsing loop.
> Three error paths inside the loop (skb_copy_seq_read() failure, invalid
> inner IPv4 header length, unknown IP version) jump to the "done" label,
> which is placed after the code sending @sublist.
> 
> Any skb already queued on @sublist is then neither delivered nor freed.
> This includes skbs added by iptfs_reassem_cont() before the call, newly
> allocated inner packets, and, since the received skb can be reused for
> the first inner packet, the received skb itself.
> 
> Move the "done" label before the trim/send code, so that inner packets
> parsed before the error are delivered as on the normal exit path. The
> received skb is then still freed (or consumed) as before when it was
> not reused.
> 
> Fixes: 6c82d2433671 ("xfrm: iptfs: add basic receive packet (tunnel egress) handling")
> Reported-by: syzbot+a3f21220cbbb6e14ee2e@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/6ae4102e.9c6421ad.36baac.0005.GAE@google.com/
> Signed-off-by: Eric Dumazet <edumazet@kernel.org>
> ---
> Cc: Steffen Klassert <steffen.klassert@secunet.com>
> Cc: Herbert Xu <herbert@gondor.apana.org.au>

@Steffen, do you prefer to take this one via your tree? Otherwise, would you mind
acking it?

Thanks,

Paolo

> ---
>   net/xfrm/xfrm_iptfs.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/net/xfrm/xfrm_iptfs.c b/net/xfrm/xfrm_iptfs.c
> index 103cf7c5dbfb..0313a43aa8a9 100644
> --- a/net/xfrm/xfrm_iptfs.c
> +++ b/net/xfrm/xfrm_iptfs.c
> @@ -1182,6 +1182,7 @@ static bool __input_process_payload(struct xfrm_state *x, u32 data,
>   		/* this should not happen from the above code */
>   		XFRM_INC_STATS(net, LINUX_MIB_XFRMINIPTFSERROR);
>   
> +done:
>   	if (first_skb && first_iplen && !defer && !first_skb_partial) {
>   		/* first_skb is queued b/c !defer and not partial */
>   		if (pskb_trim(first_skb, first_iplen)) {
> @@ -1198,7 +1199,7 @@ static bool __input_process_payload(struct xfrm_state *x, u32 data,
>   		if (xfrm_input(skb, 0, 0, -2))
>   			kfree_skb(skb);
>   	}
> -done:
> +
>   	skb = skbseq->root_skb;
>   	skb_abort_seq_read(skbseq);
>   

Re: [PATCH net] xfrm: iptfs: fix skb leak on error in __input_process_payload()

[Paolo Abeni]

re-sending to the ML, I unintentionally stripped all the CC with my previous reply
@Steffen, I'm sorry for the duplicate.

On 11/3/26 11:51, Steffen Klassert wrote:
> On Tue, Nov 03, 2026 at 09:45:28AM +0100, Paolo Abeni wrote:
>> @Steffen, do you prefer to take this one via your tree? Otherwise, would you mind
>> acking it?
> 
> I have a pending pull request for the ipsec tree, my plan
> was to apply it once the PR is merged. But since the
> ipsec tree is empty after the PR is merge, I could
> also ack it if you prefer that.
The latter option is more straight-forward, I think, thanks!

Paolo

Re: [PATCH net] xfrm: iptfs: fix skb leak on error in __input_process_payload()

[Steffen Klassert]

On Tue, Nov 03, 2026 at 09:45:28AM +0100, Paolo Abeni wrote:
> On 10/30/26 09:33, Eric Dumazet wrote:
> > syzbot reported a memory leak of the received skb (and its sec_path
> > extension) in the IP-TFS receive path.
> > 
> > __input_process_payload() parses the inner packets of an IP-TFS payload
> > and queues them on @sublist, which is only sent after the parsing loop.
> > Three error paths inside the loop (skb_copy_seq_read() failure, invalid
> > inner IPv4 header length, unknown IP version) jump to the "done" label,
> > which is placed after the code sending @sublist.
> > 
> > Any skb already queued on @sublist is then neither delivered nor freed.
> > This includes skbs added by iptfs_reassem_cont() before the call, newly
> > allocated inner packets, and, since the received skb can be reused for
> > the first inner packet, the received skb itself.
> > 
> > Move the "done" label before the trim/send code, so that inner packets
> > parsed before the error are delivered as on the normal exit path. The
> > received skb is then still freed (or consumed) as before when it was
> > not reused.
> > 
> > Fixes: 6c82d2433671 ("xfrm: iptfs: add basic receive packet (tunnel egress) handling")
> > Reported-by: syzbot+a3f21220cbbb6e14ee2e@syzkaller.appspotmail.com
> > Closes: https://lore.kernel.org/netdev/6ae4102e.9c6421ad.36baac.0005.GAE@google.com/
> > Signed-off-by: Eric Dumazet <edumazet@kernel.org>
> > ---
> > Cc: Steffen Klassert <steffen.klassert@secunet.com>
> > Cc: Herbert Xu <herbert@gondor.apana.org.au>
> 
> @Steffen, do you prefer to take this one via your tree? Otherwise, would you mind
> acking it?

I have a pending pull request for the ipsec tree, my plan
was to apply it once the PR is merged. But since the
ipsec tree is empty after the PR is merge, I could
also ack it if you prefer that.

Steffen

Re: [PATCH net] xfrm: iptfs: fix skb leak on error in __input_process_payload()

[Steffen Klassert]

On Tue, Nov 03, 2026 at 10:59:12AM +0100, Paolo Abeni wrote:
> re-sending to the ML, I unintentionally stripped all the CC with my previous reply
> @Steffen, I'm sorry for the duplicate.
> 
> On 11/3/26 11:51, Steffen Klassert wrote:
> > On Tue, Nov 03, 2026 at 09:45:28AM +0100, Paolo Abeni wrote:
> > > @Steffen, do you prefer to take this one via your tree? Otherwise, would you mind
> > > acking it?
> > 
> > I have a pending pull request for the ipsec tree, my plan
> > was to apply it once the PR is merged. But since the
> > ipsec tree is empty after the PR is merge, I could
> > also ack it if you prefer that.
> The latter option is more straight-forward, I think, thanks!

Ok, in that case:

Acked-by: Steffen Klassert <steffen.klassert@secunet.com>

Re: [PATCH net] xfrm: iptfs: fix skb leak on error in __input_process_payload()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:

On Fri, 30 Oct 2026 09:33:58 +0100 you wrote:
> syzbot reported a memory leak of the received skb (and its sec_path
> extension) in the IP-TFS receive path.
> 
> __input_process_payload() parses the inner packets of an IP-TFS payload
> and queues them on @sublist, which is only sent after the parsing loop.
> Three error paths inside the loop (skb_copy_seq_read() failure, invalid
> inner IPv4 header length, unknown IP version) jump to the "done" label,
> which is placed after the code sending @sublist.
> 
> [...]

Here is the summary with links:
  - [net] xfrm: iptfs: fix skb leak on error in __input_process_payload()
    https://git.kernel.org/netdev/net/c/64e45ed926cd

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html