Unverified Commit 8ada2a59 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!5441 net/sched: act_ct: fix skb leak and crash on ooo frags 

Merge Pull Request from: @ci-robot 
 
PR sync from: Zhengchao Shao <shaozhengchao@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/6XTIOLI5KMY5NPF4JDAU2MXBWOBDZENA/ 
 
https://gitee.com/src-openeuler/kernel/issues/I99JTC 
 
Link:https://gitee.com/openeuler/kernel/pulls/5441

 

Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents b26c5614 8f58f545

net/sched/act_ct.c

+6 −6
Original line number Diff line number Diff line
@@ -699,7 +699,6 @@ static int tcf_ct_handle_fragments(struct net *net, struct sk_buff *skb, 
	if (err || !frag)

		return err;



	skb_get(skb);

	cb = *qdisc_skb_cb(skb);



	if (family == NFPROTO_IPV4) {
@@ -973,12 +972,8 @@ static int tcf_ct_act(struct sk_buff *skb, const struct tc_action *a, 
	nh_ofs = skb_network_offset(skb);

	skb_pull_rcsum(skb, nh_ofs);

	err = tcf_ct_handle_fragments(net, skb, family, p->zone, &defrag);

	if (err == -EINPROGRESS) {

		retval = TC_ACT_STOLEN;

		goto out;

	}

	if (err)

		goto drop;

		goto out_frag;



	err = tcf_ct_skb_network_trim(skb, family);

	if (err)
@@ -1046,6 +1041,11 @@ static int tcf_ct_act(struct sk_buff *skb, const struct tc_action *a, 
		qdisc_skb_cb(skb)->pkt_len = skb->len;

	return retval;



out_frag:

	if (err != -EINPROGRESS)

		tcf_action_inc_drop_qstats(&c->common);

	return TC_ACT_CONSUMED;



drop:

	tcf_action_inc_drop_qstats(&c->common);

	return TC_ACT_SHOT;