From: Steffen Klassert <steffen.klassert@secunet.com>
To: Eyal Birger <eyal.birger@gmail.com>
Cc: Ren Wei <n05ec@lzu.edu.cn>, <netdev@vger.kernel.org>,
<herbert@gondor.apana.org.au>, <davem@davemloft.net>,
<yuantan098@gmail.com>, <bird@lzu.edu.cn>, <qianyuluo3@gmail.com>
Subject: Re: [PATCH v2 1/1] xfrm: nat_keepalive: avoid double free on send error
Date: Tue, 30 Jun 2026 16:03:39 +0200 [thread overview]
Message-ID: <akPMu8LwZN7Sz0HO@secunet.com> (raw)
In-Reply-To: <CAHsH6Gupn_PVjZjOWPRLWL6LCL=-p8Gde6_BruGdetn+eP3NMQ@mail.gmail.com>
On Sun, Jun 28, 2026 at 06:42:44AM -0700, Eyal Birger wrote:
> On Wed, Jun 24, 2026 at 10:55 PM Ren Wei <n05ec@lzu.edu.cn> wrote:
> >
> > From: Qianyu Luo <qianyuluo3@gmail.com>
> >
> > nat_keepalive_send() frees the keepalive skb whenever the IPv4 or IPv6
> > send helper reports an error.
> >
> > That cleanup is only correct before the skb is handed to the output
> > path. Once ip_build_and_send_pkt() or ip6_xmit() takes ownership, the
> > networking stack may already have consumed the skb before returning an
> > error, so freeing it again is unsafe.
> >
> > Handle the pre-handoff failure cases inside nat_keepalive_send_ipv4()
> > and nat_keepalive_send_ipv6(), where the caller still owns the skb, and
> > keep nat_keepalive_send() responsible only for family dispatch and the
> > unsupported-family cleanup path.
> >
> > Fixes: f531d13bdfe3 ("xfrm: support sending NAT keepalives in ESP in UDP states")
>
> Thanks for the fix!
>
> Reviewed-by: Eyal Birger <eyal.birger@gmail.com>
Applied, thanks everyone!
prev parent reply other threads:[~2026-06-30 14:03 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-25 5:55 [PATCH v2 1/1] xfrm: nat_keepalive: avoid double free on send error Ren Wei
2026-06-28 13:42 ` Eyal Birger
2026-06-30 14:03 ` Steffen Klassert [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=akPMu8LwZN7Sz0HO@secunet.com \
--to=steffen.klassert@secunet.com \
--cc=bird@lzu.edu.cn \
--cc=davem@davemloft.net \
--cc=eyal.birger@gmail.com \
--cc=herbert@gondor.apana.org.au \
--cc=n05ec@lzu.edu.cn \
--cc=netdev@vger.kernel.org \
--cc=qianyuluo3@gmail.com \
--cc=yuantan098@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox