Re: [PATCH net] xfrm: fix missing dst_release() after policy blocking lbcast and multicast

From: Steffen Klassert
Date: Sat Jun 23 2018 - 10:03:52 EST


On Thu, Jun 21, 2018 at 09:30:47AM +0300, Tommi Rantala wrote:
> Fix missing dst_release() when local broadcast or multicast traffic is
> xfrm policy blocked.
>
> For IPv4 this results to dst leak: ip_route_output_flow() allocates
> dst_entry via __ip_route_output_key() and passes it to
> xfrm_lookup_route(). xfrm_lookup returns ERR_PTR(-EPERM) that is
> propagated. The dst that was allocated is never released.
>
> IPv4 local broadcast testcase:
> ping -b 192.168.1.255 &
> sleep 1
> ip xfrm policy add src 0.0.0.0/0 dst 192.168.1.255/32 dir out action block
>
> IPv4 multicast testcase:
> ping 224.0.0.1 &
> sleep 1
> ip xfrm policy add src 0.0.0.0/0 dst 224.0.0.1/32 dir out action block
>
> For IPv6 the missing dst_release() causes trouble e.g. when used in netns:
> ip netns add TEST
> ip netns exec TEST ip link set lo up
> ip link add dummy0 type dummy
> ip link set dev dummy0 netns TEST
> ip netns exec TEST ip addr add fd00::1111 dev dummy0
> ip netns exec TEST ip link set dummy0 up
> ip netns exec TEST ping -6 -c 5 ff02::1%dummy0 &
> sleep 1
> ip netns exec TEST ip xfrm policy add src ::/0 dst ff02::1 dir out action block
> wait
> ip netns del TEST
>
> After netns deletion we see:
> [ 258.239097] unregister_netdevice: waiting for lo to become free. Usage count = 2
> [ 268.279061] unregister_netdevice: waiting for lo to become free. Usage count = 2
> [ 278.367018] unregister_netdevice: waiting for lo to become free. Usage count = 2
> [ 288.375259] unregister_netdevice: waiting for lo to become free. Usage count = 2
>
> Fixes: ac37e2515c1a ("xfrm: release dst_orig in case of error in xfrm_lookup()")
> Signed-off-by: Tommi Rantala <tommi.t.rantala@xxxxxxxxx>

Patch applied, thanks a lot!