Paths

Table of Contentst

Differential D58361

if_geneve: Fix mbuf leak on ip_ecn_egress
ClosedPublic
Actions

Authored by pouria on Mon, Jul 20, 8:46 PM.

Tags

None

Referenced Files

	F164563373: D58361.id182306.diff
	Sun, Aug 2, 2:56 AM

	F164467407: D58361.id182312.diff
	Sat, Aug 1, 6:02 AM

	F164461801: D58361.id182306.diff
	Sat, Aug 1, 5:22 AM

	Unknown Object (File)
	Fri, Jul 31, 5:23 AM

	Unknown Object (File)
	Fri, Jul 31, 2:10 AM

	Unknown Object (File)
	Thu, Jul 30, 12:07 PM

	Unknown Object (File)
	Thu, Jul 30, 7:15 AM

	Unknown Object (File)
	Thu, Jul 30, 3:47 AM

View All 34 Files

Subscribers

Details

Reviewers

Group Reviewers

Commits

rGe4a457d13576: if_geneve: Fix mbuf leak on ip_ecn_egress

Summary

Free mbuf and increase IFCOUNTER_IERRORS if ip_ecn_egress() under
geneve_input_inherit() decides to drop the packet.

Reported by: Chris Jarrett-Davies of the OpenAI Codex Security Team

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

pouria created this revision.Mon, Jul 20, 8:46 PM

Herald added subscribers: glebius, melifaro, ae, imp. · View Herald TranscriptMon, Jul 20, 8:46 PM

pouria requested review of this revision.Mon, Jul 20, 8:46 PM

Harbormaster completed remote builds in B74963: Diff 182306.Mon, Jul 20, 8:46 PM

pouria edited the summary of this revision. (Show Details)Mon, Jul 20, 8:59 PM

markj added inline comments.Mon, Jul 20, 9:02 PM

sys/net/if_geneve.c
3132	The m_pullup() call above may free the old mbuf. In that case, since m0 hasn't been updated, geneve_udp_input() will free the mbuf again in this error path. IMO it is easiest to just m_freem(m); m0 = NULL; return (ENOBUFS);

pouria added inline comments.Mon, Jul 20, 9:10 PM

sys/net/if_geneve.c
3127–3130	how about this one?

markj added inline comments.Mon, Jul 20, 9:14 PM

sys/net/if_geneve.c
3127–3130	That's fine too.

Address @markj comment

Harbormaster completed remote builds in B74965: Diff 182310.Mon, Jul 20, 9:16 PM

markj accepted this revision.Mon, Jul 20, 9:17 PM

markj added inline comments.

sys/net/if_geneve.c
3180–3181	Now you can remove this assignment.

This revision is now accepted and ready to land.Mon, Jul 20, 9:17 PM

Address @markj comment, remove redundant *m0 = m assignment

This revision now requires review to proceed.Mon, Jul 20, 9:21 PM

Harbormaster completed remote builds in B74966: Diff 182311.Mon, Jul 20, 9:21 PM

markj accepted this revision.Mon, Jul 20, 9:22 PM

This revision is now accepted and ready to land.Mon, Jul 20, 9:22 PM

Closed by commit rGe4a457d13576: if_geneve: Fix mbuf leak on ip_ecn_egress (authored by pouria). · Explain WhyMon, Jul 20, 9:24 PM

This revision was automatically updated to reflect the committed changes.

pouria added a commit: rGe4a457d13576: if_geneve: Fix mbuf leak on ip_ecn_egress.

markj added inline comments.Mon, Jul 20, 9:29 PM

sys/net/if_geneve.c
2844	BTW, there is a leak in this error path too, though I suspect this might not be triggerable in practice.

Revision Contents
Changeset List

Path

Size

sys/

net/

21 lines

Diff 182312

sys/net/if_geneve.c

Loading...