ipv6: Fix fib6_dump_table walker leak

When a fib6 table dump is prematurely ended, we won't unlink its walker from the list. This causes all sorts of grief for other users of the list later. Reported-by: Chris Caputo <ccaputo@alt.net> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>

ipv6: Fix fib6_dump_table walker leak
When a fib6 table dump is prematurely ended, we won't unlink its walker from the list. This causes all sorts of grief for other users of the list later. Reported-by: Chris Caputo <ccaputo@alt.net> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
Herbert Xu · David S. Miller
1 parent 33966dd0e2
Showing 1 changed file with 8 additions and 7 deletions Side-by-side Diff
net/ipv6/ip6_fib.c
@@ -298,6 +298,10 @@
 	struct fib6_walker_t *w = (void*)cb->args[2];
  
 	if (w) {
+		if (cb->args[4]) {
+			cb->args[4] = 0;
+			fib6_walker_unlink(w);
+		}
 		cb->args[2] = 0;
 		kfree(w);
 	}
  
  
@@ -330,15 +334,12 @@
 		read_lock_bh(&table->tb6_lock);
 		res = fib6_walk_continue(w);
 		read_unlock_bh(&table->tb6_lock);
-		if (res != 0) {
-			if (res < 0)
-				fib6_walker_unlink(w);
-			goto end;
+		if (res <= 0) {
+			fib6_walker_unlink(w);
+			cb->args[4] = 0;
 		}
-		fib6_walker_unlink(w);
-		cb->args[4] = 0;
 	}
-end:
+
 	return res;
 }
...	...	@@ -298,6 +298,10 @@
298	298	struct fib6_walker_t w = (void)cb->args[2];
299	299
300	300	if (w) {
	301	+ if (cb->args[4]) {
	302	+ cb->args[4] = 0;
	303	+ fib6_walker_unlink(w);
	304	+ }
301	305	cb->args[2] = 0;
302	306	kfree(w);
303	307	}
304	308
305	309
...	...	@@ -330,15 +334,12 @@
330	334	read_lock_bh(&table->tb6_lock);
331	335	res = fib6_walk_continue(w);
332	336	read_unlock_bh(&table->tb6_lock);
333		- if (res != 0) {
334		- if (res < 0)
335		- fib6_walker_unlink(w);
336		- goto end;
	337	+ if (res <= 0) {
	338	+ fib6_walker_unlink(w);
	339	+ cb->args[4] = 0;
337	340	}
338		- fib6_walker_unlink(w);
339		- cb->args[4] = 0;
340	341	}
341		-end:
	342	+
342	343	return res;
343	344	}
344	345