Skip to content

Commit

Permalink
6lowpan: move skb_free from error paths in decompression
Browse files Browse the repository at this point in the history 
Currently we ensure that the skb is freed on every error path in IPHC
decompression which makes it easy to introduce skb leaks.  By centralising
the skb_free into the receive function it makes future decompression routines
easier to maintain.  It does come at the expense of ensuring that the skb
passed into the decompression routine must not be copied.

Signed-off-by: Martin Townsend <[email protected]>
Acked-by: Jukka Rissanen <[email protected]>
Acked-by: Alexander Aring <[email protected]>
Signed-off-by: Marcel Holtmann <[email protected]>
  • Loading branch information
@martintownsend @holtmann
martintownsend authored and holtmann committed Nov 6, 2014
1 parent 9645c76 commit 56b2c3e
Show file tree
Hide file tree
Showing 3 changed files with 25 additions and 37 deletions.
31 changes: 12 additions & 19 deletions net/6lowpan/iphc.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -319,7 +319,7 @@ lowpan_header_decompress(struct sk_buff *skb, struct net_device *dev,
if (iphc1 & LOWPAN_IPHC_CID) {
pr_debug("CID flag is set, increase header with one\n");
if (lowpan_fetch_skb(skb, &num_context, sizeof(num_context)))
goto drop;
return -EINVAL;
}

hdr.version = 6;
Expand All @@ -331,7 +331,7 @@ lowpan_header_decompress(struct sk_buff *skb, struct net_device *dev,
*/
case 0: /* 00b */
if (lowpan_fetch_skb(skb, &tmp, sizeof(tmp)))
goto drop;
return -EINVAL;

memcpy(&hdr.flow_lbl, &skb->data[0], 3);
skb_pull(skb, 3);
Expand All @@ -344,7 +344,7 @@ lowpan_header_decompress(struct sk_buff *skb, struct net_device *dev,
*/
case 2: /* 10b */
if (lowpan_fetch_skb(skb, &tmp, sizeof(tmp)))
goto drop;
return -EINVAL;

hdr.priority = ((tmp >> 2) & 0x0f);
hdr.flow_lbl[0] = ((tmp << 6) & 0xC0) | ((tmp >> 2) & 0x30);
Expand All @@ -354,7 +354,7 @@ lowpan_header_decompress(struct sk_buff *skb, struct net_device *dev,
*/
case 1: /* 01b */
if (lowpan_fetch_skb(skb, &tmp, sizeof(tmp)))
goto drop;
return -EINVAL;

hdr.flow_lbl[0] = (skb->data[0] & 0x0F) | ((tmp >> 2) & 0x30);
memcpy(&hdr.flow_lbl[1], &skb->data[0], 2);
Expand All @@ -371,7 +371,7 @@ lowpan_header_decompress(struct sk_buff *skb, struct net_device *dev,
if ((iphc0 & LOWPAN_IPHC_NH_C) == 0) {
/* Next header is carried inline */
if (lowpan_fetch_skb(skb, &hdr.nexthdr, sizeof(hdr.nexthdr)))
goto drop;
return -EINVAL;

pr_debug("NH flag is set, next header carried inline: %02x\n",
hdr.nexthdr);
Expand All @@ -383,7 +383,7 @@ lowpan_header_decompress(struct sk_buff *skb, struct net_device *dev,
} else {
if (lowpan_fetch_skb(skb, &hdr.hop_limit,
sizeof(hdr.hop_limit)))
goto drop;
return -EINVAL;
}

/* Extract SAM to the tmp variable */
Expand All @@ -402,7 +402,7 @@ lowpan_header_decompress(struct sk_buff *skb, struct net_device *dev,

/* Check on error of previous branch */
if (err)
goto drop;
return -EINVAL;

/* Extract DAM to the tmp variable */
tmp = ((iphc1 & LOWPAN_IPHC_DAM_11) >> LOWPAN_IPHC_DAM_BIT) & 0x03;
Expand All @@ -417,15 +417,15 @@ lowpan_header_decompress(struct sk_buff *skb, struct net_device *dev,
tmp);

if (err)
goto drop;
return -EINVAL;
}
} else {
err = uncompress_addr(skb, &hdr.daddr, tmp, daddr,
daddr_type, daddr_len);
pr_debug("dest: stateless compression mode %d dest %pI6c\n",
tmp, &hdr.daddr);
if (err)
goto drop;
return -EINVAL;
}

/* UDP data uncompression */
Expand All @@ -434,16 +434,14 @@ lowpan_header_decompress(struct sk_buff *skb, struct net_device *dev,
const int needed = sizeof(struct udphdr) + sizeof(hdr);

if (uncompress_udp_header(skb, &uh))
goto drop;
return -EINVAL;

/* replace the compressed UDP head by the uncompressed UDP
* header
*/
err = skb_cow(skb, needed);
if (unlikely(err)) {
kfree_skb(skb);
if (unlikely(err))
return err;
}

skb_push(skb, sizeof(struct udphdr));
skb_reset_transport_header(skb);
Expand All @@ -455,10 +453,8 @@ lowpan_header_decompress(struct sk_buff *skb, struct net_device *dev,
hdr.nexthdr = UIP_PROTO_UDP;
} else {
err = skb_cow(skb, sizeof(hdr));
if (unlikely(err)) {
kfree_skb(skb);
if (unlikely(err))
return err;
}
}

hdr.payload_len = htons(skb->len);
Expand All @@ -478,9 +474,6 @@ lowpan_header_decompress(struct sk_buff *skb, struct net_device *dev,
raw_dump_table(__func__, "raw header dump", (u8 *)&hdr, sizeof(hdr));

return 0;
drop:
kfree_skb(skb);
return -EINVAL;
}
EXPORT_SYMBOL_GPL(lowpan_header_decompress);

Expand Down
15 changes: 7 additions & 8 deletions net/bluetooth/6lowpan.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -294,30 +294,27 @@ static int iphc_decompress(struct sk_buff *skb, struct net_device *netdev,
peer = __peer_lookup_chan(dev, chan);
rcu_read_unlock();
if (!peer)
goto drop;
return -EINVAL;

saddr = peer->eui64_addr;
daddr = dev->netdev->dev_addr;

/* at least two bytes will be used for the encoding */
if (skb->len < 2)
goto drop;
return -EINVAL;

if (lowpan_fetch_skb_u8(skb, &iphc0))
goto drop;
return -EINVAL;

if (lowpan_fetch_skb_u8(skb, &iphc1))
goto drop;
return -EINVAL;

return lowpan_header_decompress(skb, netdev,
saddr, IEEE802154_ADDR_LONG,
EUI64_ADDR_LEN, daddr,
IEEE802154_ADDR_LONG, EUI64_ADDR_LEN,
iphc0, iphc1);

drop:
kfree_skb(skb);
return -EINVAL;
}

static int recv_pkt(struct sk_buff *skb, struct net_device *dev,
Expand Down Expand Up @@ -370,8 +367,10 @@ static int recv_pkt(struct sk_buff *skb, struct net_device *dev,
goto drop;

ret = iphc_decompress(local_skb, dev, chan);
if (ret < 0)
if (ret < 0) {
kfree_skb(local_skb);
goto drop;
}

local_skb->protocol = htons(ETH_P_IPV6);
local_skb->pkt_type = PACKET_HOST;
Expand Down
16 changes: 6 additions & 10 deletions net/ieee802154/6lowpan_rtnl.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -176,13 +176,13 @@ iphc_decompress(struct sk_buff *skb, const struct ieee802154_hdr *hdr)
raw_dump_table(__func__, "raw skb data dump", skb->data, skb->len);
/* at least two bytes will be used for the encoding */
if (skb->len < 2)
goto drop;
return -EINVAL;

if (lowpan_fetch_skb_u8(skb, &iphc0))
goto drop;
return -EINVAL;

if (lowpan_fetch_skb_u8(skb, &iphc1))
goto drop;
return -EINVAL;

ieee802154_addr_to_sa(&sa, &hdr->source);
ieee802154_addr_to_sa(&da, &hdr->dest);
Expand All @@ -200,10 +200,6 @@ iphc_decompress(struct sk_buff *skb, const struct ieee802154_hdr *hdr)
return lowpan_header_decompress(skb, skb->dev, sap, sa.addr_type,
IEEE802154_ADDR_LEN, dap, da.addr_type,
IEEE802154_ADDR_LEN, iphc0, iphc1);

drop:
kfree_skb(skb);
return -EINVAL;
}

static struct sk_buff*
Expand Down Expand Up @@ -522,15 +518,15 @@ static int lowpan_rcv(struct sk_buff *skb, struct net_device *dev,
case LOWPAN_DISPATCH_IPHC: /* ipv6 datagram */
ret = iphc_decompress(skb, &hdr);
if (ret < 0)
goto drop;
goto drop_skb;

return lowpan_give_skb_to_devices(skb, NULL);
case LOWPAN_DISPATCH_FRAG1: /* first fragment header */
ret = lowpan_frag_rcv(skb, LOWPAN_DISPATCH_FRAG1);
if (ret == 1) {
ret = iphc_decompress(skb, &hdr);
if (ret < 0)
goto drop;
goto drop_skb;

return lowpan_give_skb_to_devices(skb, NULL);
} else if (ret == -1) {
Expand All @@ -543,7 +539,7 @@ static int lowpan_rcv(struct sk_buff *skb, struct net_device *dev,
if (ret == 1) {
ret = iphc_decompress(skb, &hdr);
if (ret < 0)
goto drop;
goto drop_skb;

return lowpan_give_skb_to_devices(skb, NULL);
} else if (ret == -1) {
Expand Down

0 comments on commit 56b2c3e

Please sign in to comment.