Patch "net: esp: cleanup esp_output_tail_tcp() in case of unsupported ESPINTCP" has been added to the 6.1-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    net: esp: cleanup esp_output_tail_tcp() in case of unsupported ESPINTCP

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net-esp-cleanup-esp_output_tail_tcp-in-case-of-unsup.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 3df18897a96c792da5e28ae7803c960a1d3fd825
Author: Hagar Hemdan <hagarhem@xxxxxxxxxx>
Date:   Sat May 18 13:04:39 2024 +0000

    net: esp: cleanup esp_output_tail_tcp() in case of unsupported ESPINTCP
    
    [ Upstream commit 96f887a612e4cda89efc3f54bc10c1997e3ab0e9 ]
    
    xmit() functions should consume skb or return error codes in error
    paths.
    When the configuration "CONFIG_INET_ESPINTCP" is not set, the
    implementation of the function "esp_output_tail_tcp" violates this rule.
    The function frees the skb and returns the error code.
    This change removes the kfree_skb from both functions, for both
    esp4 and esp6.
    WARN_ON is added because esp_output_tail_tcp() should never be called if
    CONFIG_INET_ESPINTCP is not set.
    
    This bug was discovered and resolved using Coverity Static Analysis
    Security Testing (SAST) by Synopsys, Inc.
    
    Fixes: e27cca96cd68 ("xfrm: add espintcp (RFC 8229)")
    Signed-off-by: Hagar Hemdan <hagarhem@xxxxxxxxxx>
    Signed-off-by: Steffen Klassert <steffen.klassert@xxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index e2546961add3e..419969b268225 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -238,8 +238,7 @@ static int esp_output_tail_tcp(struct xfrm_state *x, struct sk_buff *skb)
 #else
 static int esp_output_tail_tcp(struct xfrm_state *x, struct sk_buff *skb)
 {
-	kfree_skb(skb);
-
+	WARN_ON(1);
 	return -EOPNOTSUPP;
 }
 #endif
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index c2dcb5c613b6b..a021c88d3d9b8 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -255,8 +255,7 @@ static int esp_output_tail_tcp(struct xfrm_state *x, struct sk_buff *skb)
 #else
 static int esp_output_tail_tcp(struct xfrm_state *x, struct sk_buff *skb)
 {
-	kfree_skb(skb);
-
+	WARN_ON(1);
 	return -EOPNOTSUPP;
 }
 #endif




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux