Commit 71f6f6dfdf7c7a67462386d9ea05c1095a89c555
Committed by
David S. Miller
1 parent
a170285772
Exists in
master
and in
7 other branches
ipv6: Plug sk_buff leak in ipv6_rcv (net/ipv6/ip6_input.c)
Commit 778d80be52699596bf70e0eb0761cf5e1e46088d (ipv6: Add disable_ipv6 sysctl to disable IPv6 operaion on specific interface) seems to have introduced a leak of sk_buff's for ipv6 traffic, at least in some configurations where idev is NULL, or when ipv6 is disabled via sysctl. The problem is that if the first condition of the if-statement returns non-NULL, it returns an skb with only one reference, and when the other conditions apply, execution jumps to the "out" label, which does not call kfree_skb for it. To plug this leak, change to use the "drop" label instead. (this relies on it being ok to call kfree_skb on NULL) This also allows us to avoid calling rcu_read_unlock here, and removes the only user of the "out" label. Signed-off-by: Jesper Nilsson <jesper.nilsson@axis.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Showing 1 changed file with 1 additions and 3 deletions Side-by-side Diff
net/ipv6/ip6_input.c
... | ... | @@ -75,8 +75,7 @@ |
75 | 75 | if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL || |
76 | 76 | !idev || unlikely(idev->cnf.disable_ipv6)) { |
77 | 77 | IP6_INC_STATS_BH(net, idev, IPSTATS_MIB_INDISCARDS); |
78 | - rcu_read_unlock(); | |
79 | - goto out; | |
78 | + goto drop; | |
80 | 79 | } |
81 | 80 | |
82 | 81 | memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm)); |
... | ... | @@ -147,7 +146,6 @@ |
147 | 146 | drop: |
148 | 147 | rcu_read_unlock(); |
149 | 148 | kfree_skb(skb); |
150 | -out: | |
151 | 149 | return 0; |
152 | 150 | } |
153 | 151 |