| Message ID | da9ffa03a9260042f5f325b1e7d56ded32d846b5.1439978875.git.jbenc@redhat.com |
|---|---|
| State | Superseded, archived |
| Delegated to: | David Miller |
| Headers | show |
On 08/19/15 at 12:09pm, Jiri Benc wrote: > The fix in commit 48fb6b554501 is incomplete, as now ip6_route_input can be > called with non-NULL dst if it's a metadata dst and the reference is leaked. > Drop the reference. > > Fixes: 48fb6b554501 ("ipv6: fix crash over flow-based vxlan device") > Fixes: ee122c79d422 ("vxlan: Flow based tunneling") > CC: Wei-Chun Chao <weichunc@plumgrid.com> > CC: Thomas Graf <tgraf@suug.ch> > Signed-off-by: Jiri Benc <jbenc@redhat.com> Acked-by: Thomas Graf <tgraf@suug.ch> -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/ipv6/route.c b/net/ipv6/route.c index e6bbcdee7707..0947ad0b3de8 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -1140,6 +1140,7 @@ void ip6_route_input(struct sk_buff *skb) .flowi6_proto = iph->nexthdr, }; + skb_dst_drop(skb); skb_dst_set(skb, ip6_route_input_lookup(net, skb->dev, &fl6, flags)); }
The fix in commit 48fb6b554501 is incomplete, as now ip6_route_input can be called with non-NULL dst if it's a metadata dst and the reference is leaked. Drop the reference. Fixes: 48fb6b554501 ("ipv6: fix crash over flow-based vxlan device") Fixes: ee122c79d422 ("vxlan: Flow based tunneling") CC: Wei-Chun Chao <weichunc@plumgrid.com> CC: Thomas Graf <tgraf@suug.ch> Signed-off-by: Jiri Benc <jbenc@redhat.com> --- net/ipv6/route.c | 1 + 1 file changed, 1 insertion(+)