Paths

Table of Contentst

Differential D58361

if_geneve: Fix mbuf leak on ip_ecn_egress
ClosedPublic
Actions

Authored by pouria on Mon, Jul 20, 8:46 PM.

Tags

None

Referenced Files

	F164275600: D58361.diff
	Thu, Jul 30, 7:15 AM

	F164255161: D58361.id182311.diff
	Thu, Jul 30, 3:47 AM

	Unknown Object (File)
	Tue, Jul 28, 1:58 AM

	Unknown Object (File)
	Mon, Jul 27, 10:50 PM

	Unknown Object (File)
	Mon, Jul 27, 6:24 AM

	Unknown Object (File)
	Mon, Jul 27, 4:12 AM

	Unknown Object (File)
	Sun, Jul 26, 11:15 PM

	Unknown Object (File)
	Sun, Jul 26, 9:17 PM

View All 28 Files

Subscribers

Details

Reviewers

Group Reviewers

Commits

rGe4a457d13576: if_geneve: Fix mbuf leak on ip_ecn_egress

Summary

Free mbuf and increase IFCOUNTER_IERRORS if ip_ecn_egress() under
geneve_input_inherit() decides to drop the packet.

Reported by: Chris Jarrett-Davies of the OpenAI Codex Security Team

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Skipped

Unit

Tests Skipped

Build Status

Buildable 74966
Build 71849: arc lint + arc unit

Event Timeline

pouria created this revision.Mon, Jul 20, 8:46 PM

Herald added subscribers: glebius, melifaro, ae, imp. · View Herald TranscriptMon, Jul 20, 8:46 PM

pouria requested review of this revision.Mon, Jul 20, 8:46 PM

Harbormaster completed remote builds in B74963: Diff 182306.Mon, Jul 20, 8:46 PM

pouria edited the summary of this revision. (Show Details)Mon, Jul 20, 8:59 PM

markj added inline comments.Mon, Jul 20, 9:02 PM

sys/net/if_geneve.c
3132	The m_pullup() call above may free the old mbuf. In that case, since m0 hasn't been updated, geneve_udp_input() will free the mbuf again in this error path. IMO it is easiest to just m_freem(m); m0 = NULL; return (ENOBUFS);

pouria added inline comments.Mon, Jul 20, 9:10 PM

sys/net/if_geneve.c
3127–3130	how about this one?

markj added inline comments.Mon, Jul 20, 9:14 PM

sys/net/if_geneve.c
3127–3130	That's fine too.

Address @markj comment

Harbormaster completed remote builds in B74965: Diff 182310.Mon, Jul 20, 9:16 PM

markj accepted this revision.Mon, Jul 20, 9:17 PM

markj added inline comments.

sys/net/if_geneve.c
3180–3181	Now you can remove this assignment.

This revision is now accepted and ready to land.Mon, Jul 20, 9:17 PM

Address @markj comment, remove redundant *m0 = m assignment

This revision now requires review to proceed.Mon, Jul 20, 9:21 PM

Harbormaster completed remote builds in B74966: Diff 182311.Mon, Jul 20, 9:21 PM

markj accepted this revision.Mon, Jul 20, 9:22 PM

This revision is now accepted and ready to land.Mon, Jul 20, 9:22 PM

Closed by commit rGe4a457d13576: if_geneve: Fix mbuf leak on ip_ecn_egress (authored by pouria). · Explain WhyMon, Jul 20, 9:24 PM

This revision was automatically updated to reflect the committed changes.

pouria added a commit: rGe4a457d13576: if_geneve: Fix mbuf leak on ip_ecn_egress.

markj added inline comments.Mon, Jul 20, 9:29 PM

sys/net/if_geneve.c
2844	BTW, there is a leak in this error path too, though I suspect this might not be triggerable in practice.

Revision Contents
Changeset List

Path

Size

sys/

net/

21 lines

Diff 182311

sys/net/if_geneve.c

Loading...