openvswitch: Fix skb leak using IPv6 defrag
authorJoe Stringer <joestringer@nicira.com>
Mon, 26 Oct 2015 03:21:50 +0000 (20:21 -0700)
committerDavid S. Miller <davem@davemloft.net>
Wed, 28 Oct 2015 02:32:18 +0000 (19:32 -0700)
commit6f5cadee44d83395dcd78d557b577e1021e192e4
tree1acd86609a240077c790830174ae660fe33a5517
parent190b8ffbb700a9aa47acc559779bc79c0cb14766
openvswitch: Fix skb leak using IPv6 defrag

nf_ct_frag6_gather() makes a clone of each skb passed to it, and if the
reassembly is successful, expects the caller to free all of the original
skbs using nf_ct_frag6_consume_orig(). This call was previously missing,
meaning that the original fragments were never freed (with the exception
of the last fragment to arrive).

Fix this by ensuring that all original fragments except for the last
fragment are freed via nf_ct_frag6_consume_orig(). The last fragment
will be morphed into the head, so it must not be freed yet. Furthermore,
retain the ->next pointer for the head after skb_morph().

Fixes: 7f8a436eaa2c ("openvswitch: Add conntrack action")
Reported-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Joe Stringer <joestringer@nicira.com>
Acked-by: Pravin B Shelar <pshelar@nicira.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/openvswitch/conntrack.c