Re: [PATCH] xfrm: Fix xfrm_state refcnt leak in xfrm_input()

[Steffen Klassert]

On Thu, Apr 23, 2020 at 01:19:20PM +0800, Xiyu Yang wrote:
> xfrm_input() invokes xfrm_state_lookup(), which returns a reference of
> the specified xfrm_state object to "x" with increased refcnt and then
> "x" is escaped to "sp->xvec[]".
> 
> When xfrm_input() encounters error, it calls kfree_skb() to free the
> "skb" memory. Since "sp" comes from one of "skb" fields, this "free"
> behavior causes "sp" becomes invalid, so the refcount for its field
> should be decreased to keep refcount balanced before kfree_skb() calls.
> 
> The reference counting issue happens in several exception handling paths
> of xfrm_input(). When those error scenarios occur such as skb_dst()
> fails, the function forgets to decrease the refcnt increased by
> xfrm_state_lookup() and directly calls kfree_skb(), causing a refcnt
> leak.

kfree_skb() drops these refcounts already, why should we do that here
too?