Messages in this thread Patch in this message | | | Date | Wed, 29 Apr 2009 15:07:14 -0700 | From | Greg KH <> | Subject | [patch 15/58] ipv6: Plug sk_buff leak in ipv6_rcv (net/ipv6/ip6_input.c) |
| |
2.6.27-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jesper Nilsson <jesper.nilsson@axis.com>
[ Upstream commit 71f6f6dfdf7c7a67462386d9ea05c1095a89c555 ]
Commit 778d80be52699596bf70e0eb0761cf5e1e46088d (ipv6: Add disable_ipv6 sysctl to disable IPv6 operaion on specific interface) seems to have introduced a leak of sk_buff's for ipv6 traffic, at least in some configurations where idev is NULL, or when ipv6 is disabled via sysctl.
The problem is that if the first condition of the if-statement returns non-NULL, it returns an skb with only one reference, and when the other conditions apply, execution jumps to the "out" label, which does not call kfree_skb for it.
To plug this leak, change to use the "drop" label instead. (this relies on it being ok to call kfree_skb on NULL) This also allows us to avoid calling rcu_read_unlock here, and removes the only user of the "out" label.
Signed-off-by: Jesper Nilsson <jesper.nilsson@axis.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
--- net/ipv6/ip6_input.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
--- a/net/ipv6/ip6_input.c +++ b/net/ipv6/ip6_input.c @@ -74,8 +74,7 @@ int ipv6_rcv(struct sk_buff *skb, struct if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL || !idev || unlikely(idev->cnf.disable_ipv6)) { IP6_INC_STATS_BH(idev, IPSTATS_MIB_INDISCARDS); - rcu_read_unlock(); - goto out; + goto drop; } memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm)); @@ -145,7 +144,6 @@ err: drop: rcu_read_unlock(); kfree_skb(skb); -out: return 0; }
| |