[PATCH v3 1/2] ip_tunnel: fix potential issue in ip_tunnel_rcv

When ip_tunnel_rcv fails, the tun_dst won't be freed, so call
dst_release to free it in error code path.

CC: Pravin B Shelar <redacted>
Fixes: 2e15ea390e6f ("ip_gre: Add support to collect tunnel metadata.")
Signed-off-by: Haishuang Yan <redacted>

---
Changes in v2:
  - Add the the missing Fixes information
Changes in v3:
  - Free tun_dst from error code path
---
 net/ipv4/ip_tunnel.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index b878ecb..0f1d876 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c

@@ -446,6 +446,8 @@ int ip_tunnel_rcv(struct ip_tunnel *tunnel, struct sk_buff *skb,
 	return 0;
 
 drop:
+	if (tun_dst)
+		dst_release((struct dst_entry *)tun_dst);
 	kfree_skb(skb);
 	return 0;
 }

-- 
1.8.3.1

When __ip6_tnl_rcv fails, the tun_dst won't be freed, so call
dst_release to free it in error code path.

CC: Alexei Starovoitov <redacted>
Fixes: 8d79266bc48c ("ip6_tunnel: add collect_md mode to IPv6 tunnels")
Signed-off-by: Haishuang Yan <redacted>

---
Changes in v2:
  - Add the the missing Fixes information
Changes in v3:
  - Free tun_dst from error code path
---
 net/ipv6/ip6_tunnel.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 9b37f97..ef99d59 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c

@@ -859,6 +859,8 @@ static int __ip6_tnl_rcv(struct ip6_tnl *tunnel, struct sk_buff *skb,
 	return 0;
 
 drop:
+	if (tun_dst)
+		dst_release((struct dst_entry *)tun_dst);
 	kfree_skb(skb);
 	return 0;
 }

-- 
1.8.3.1

On Thu, Jun 08, 2017 at 12:32:44PM +0800, Haishuang Yan wrote:

When __ip6_tnl_rcv fails, the tun_dst won't be freed, so call
dst_release to free it in error code path.

CC: Alexei Starovoitov <redacted>
Fixes: 8d79266bc48c ("ip6_tunnel: add collect_md mode to IPv6 tunnels")
Signed-off-by: Haishuang Yan <redacted>

I don't get it. Why did you send another version of the patch?
What was wrong with previous approach that myself and Eric acked?

On Wed, Jun 7, 2017 at 9:38 PM, Alexei Starovoitov
[off-list ref] wrote:

On Thu, Jun 08, 2017 at 12:32:44PM +0800, Haishuang Yan wrote:

quoted

When __ip6_tnl_rcv fails, the tun_dst won't be freed, so call
dst_release to free it in error code path.

CC: Alexei Starovoitov <redacted>
Fixes: 8d79266bc48c ("ip6_tunnel: add collect_md mode to IPv6 tunnels")
Signed-off-by: Haishuang Yan <redacted>

I don't get it. Why did you send another version of the patch?
What was wrong with previous approach that myself and Eric acked?

Answer lies in Pravin feedback on v2 of the patch on ipv4 side.

On Thu, 2017-06-08 at 12:32 +0800, Haishuang Yan wrote:

Acked-by: Eric Dumazet <redacted>

On Wed, Jun 7, 2017 at 9:32 PM, Haishuang Yan
[off-list ref] wrote:

When ip_tunnel_rcv fails, the tun_dst won't be freed, so call
dst_release to free it in error code path.

CC: Pravin B Shelar <redacted>
Fixes: 2e15ea390e6f ("ip_gre: Add support to collect tunnel metadata.")
Signed-off-by: Haishuang Yan <redacted>

---
Changes in v2:
  - Add the the missing Fixes information
Changes in v3:
  - Free tun_dst from error code path
---

Acked-by: Pravin B Shelar <redacted>