| Message ID | 1517832635-18376-1-git-send-email-alexey.kodanev@oracle.com |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
| Series | sctp: fix dst refcnt leak in sctp_v6_get_dst() | expand |
On Mon, Feb 05, 2018 at 03:10:35PM +0300, Alexey Kodanev wrote: > When going through the bind address list in sctp_v6_get_dst() and > the previously found address is better ('matchlen > bmatchlen'), > the code continues to the next iteration without releasing currently > held destination. > > Fix it by releasing 'bdst' before continue to the next iteration, and > instead of introducing one more '!IS_ERR(bdst)' check for dst_release(), > move the already existed one right after ip6_dst_lookup_flow(), i.e. we > shouldn't proceed further if we get an error for the route lookup. > > Fixes: dbc2b5e9a09e ("sctp: fix src address selection if using secondary addresses for ipv6") > Signed-off-by: Alexey Kodanev <alexey.kodanev@oracle.com> > --- > net/sctp/ipv6.c | 10 +++++++--- > 1 files changed, 7 insertions(+), 3 deletions(-) > > diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c > index 5d4c15b..e35d4f7 100644 > --- a/net/sctp/ipv6.c > +++ b/net/sctp/ipv6.c > @@ -326,8 +326,10 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr, > final_p = fl6_update_dst(fl6, rcu_dereference(np->opt), &final); > bdst = ip6_dst_lookup_flow(sk, fl6, final_p); > > - if (!IS_ERR(bdst) && > - ipv6_chk_addr(dev_net(bdst->dev), > + if (IS_ERR(bdst)) > + continue; > + > + if (ipv6_chk_addr(dev_net(bdst->dev), > &laddr->a.v6.sin6_addr, bdst->dev, 1)) { > if (!IS_ERR_OR_NULL(dst)) > dst_release(dst); > @@ -336,8 +338,10 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr, > } > > bmatchlen = sctp_v6_addr_match_len(daddr, &laddr->a); > - if (matchlen > bmatchlen) > + if (matchlen > bmatchlen) { > + dst_release(bdst); > continue; > + } > > if (!IS_ERR_OR_NULL(dst)) > dst_release(dst); > -- > 1.7.1 > > Acked-by: Neil Horman <nhorman@tuxdriver.com>
On Mon, Feb 05, 2018 at 03:10:35PM +0300, Alexey Kodanev wrote: > When going through the bind address list in sctp_v6_get_dst() and > the previously found address is better ('matchlen > bmatchlen'), > the code continues to the next iteration without releasing currently > held destination. > > Fix it by releasing 'bdst' before continue to the next iteration, and > instead of introducing one more '!IS_ERR(bdst)' check for dst_release(), > move the already existed one right after ip6_dst_lookup_flow(), i.e. we > shouldn't proceed further if we get an error for the route lookup. > > Fixes: dbc2b5e9a09e ("sctp: fix src address selection if using secondary addresses for ipv6") > Signed-off-by: Alexey Kodanev <alexey.kodanev@oracle.com> Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> > --- > net/sctp/ipv6.c | 10 +++++++--- > 1 files changed, 7 insertions(+), 3 deletions(-) > > diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c > index 5d4c15b..e35d4f7 100644 > --- a/net/sctp/ipv6.c > +++ b/net/sctp/ipv6.c > @@ -326,8 +326,10 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr, > final_p = fl6_update_dst(fl6, rcu_dereference(np->opt), &final); > bdst = ip6_dst_lookup_flow(sk, fl6, final_p); > > - if (!IS_ERR(bdst) && > - ipv6_chk_addr(dev_net(bdst->dev), > + if (IS_ERR(bdst)) > + continue; > + > + if (ipv6_chk_addr(dev_net(bdst->dev), > &laddr->a.v6.sin6_addr, bdst->dev, 1)) { > if (!IS_ERR_OR_NULL(dst)) > dst_release(dst); > @@ -336,8 +338,10 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr, > } > > bmatchlen = sctp_v6_addr_match_len(daddr, &laddr->a); > - if (matchlen > bmatchlen) > + if (matchlen > bmatchlen) { > + dst_release(bdst); > continue; > + } > > if (!IS_ERR_OR_NULL(dst)) > dst_release(dst); > -- > 1.7.1 > > -- > To unsubscribe from this list: send the line "unsubscribe linux-sctp" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html >
From: Alexey Kodanev <alexey.kodanev@oracle.com> Date: Mon, 5 Feb 2018 15:10:35 +0300 > When going through the bind address list in sctp_v6_get_dst() and > the previously found address is better ('matchlen > bmatchlen'), > the code continues to the next iteration without releasing currently > held destination. > > Fix it by releasing 'bdst' before continue to the next iteration, and > instead of introducing one more '!IS_ERR(bdst)' check for dst_release(), > move the already existed one right after ip6_dst_lookup_flow(), i.e. we > shouldn't proceed further if we get an error for the route lookup. > > Fixes: dbc2b5e9a09e ("sctp: fix src address selection if using secondary addresses for ipv6") > Signed-off-by: Alexey Kodanev <alexey.kodanev@oracle.com> Applied and queued up for -stable, thank you.
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c index 5d4c15b..e35d4f7 100644 --- a/net/sctp/ipv6.c +++ b/net/sctp/ipv6.c @@ -326,8 +326,10 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr, final_p = fl6_update_dst(fl6, rcu_dereference(np->opt), &final); bdst = ip6_dst_lookup_flow(sk, fl6, final_p); - if (!IS_ERR(bdst) && - ipv6_chk_addr(dev_net(bdst->dev), + if (IS_ERR(bdst)) + continue; + + if (ipv6_chk_addr(dev_net(bdst->dev), &laddr->a.v6.sin6_addr, bdst->dev, 1)) { if (!IS_ERR_OR_NULL(dst)) dst_release(dst); @@ -336,8 +338,10 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr, } bmatchlen = sctp_v6_addr_match_len(daddr, &laddr->a); - if (matchlen > bmatchlen) + if (matchlen > bmatchlen) { + dst_release(bdst); continue; + } if (!IS_ERR_OR_NULL(dst)) dst_release(dst);
When going through the bind address list in sctp_v6_get_dst() and the previously found address is better ('matchlen > bmatchlen'), the code continues to the next iteration without releasing currently held destination. Fix it by releasing 'bdst' before continue to the next iteration, and instead of introducing one more '!IS_ERR(bdst)' check for dst_release(), move the already existed one right after ip6_dst_lookup_flow(), i.e. we shouldn't proceed further if we get an error for the route lookup. Fixes: dbc2b5e9a09e ("sctp: fix src address selection if using secondary addresses for ipv6") Signed-off-by: Alexey Kodanev <alexey.kodanev@oracle.com> --- net/sctp/ipv6.c | 10 +++++++--- 1 files changed, 7 insertions(+), 3 deletions(-)