Message ID | 20090114053534.GA15267@gondor.apana.org.au |
---|---|
State | Accepted, archived |
Delegated to: | David Miller |
Headers | show |
On Wed, 14 Jan 2009, Herbert Xu wrote: > I'm surprised that it's taken nearly 3 years for this bug to > show itself. It even survived a move from route.c :) > > ipv6: Fix fib6_dump_table walker leak > > When a fib6 table dump is prematurely ended, we won't unlink > its walker from the list. This causes all sorts of grief for > other users of the list later. > > Reported-by: Chris Caputo <ccaputo@alt.net> > Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> > > diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c > index 29c7c99..52ee1dc 100644 I applied the patch, rebooted and performed about a hundred "ip -6 route | head" commands with the full v6 route table. The fix works great! Any chance of vectoring it for 2.6.28.x? Thanks, Chris -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
From: Chris Caputo <ccaputo@alt.net> Date: Wed, 14 Jan 2009 06:15:38 +0000 (UTC) > On Wed, 14 Jan 2009, Herbert Xu wrote: > > I'm surprised that it's taken nearly 3 years for this bug to > > show itself. It even survived a move from route.c :) > > > > ipv6: Fix fib6_dump_table walker leak > > > > When a fib6 table dump is prematurely ended, we won't unlink > > its walker from the list. This causes all sorts of grief for > > other users of the list later. > > > > Reported-by: Chris Caputo <ccaputo@alt.net> > > Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> > > > > diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c > > index 29c7c99..52ee1dc 100644 > > I applied the patch, rebooted and performed about a hundred "ip -6 route | > head" commands with the full v6 route table. The fix works great! > > Any chance of vectoring it for 2.6.28.x? Sure, I'll queue it up for -stable. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
From: Herbert Xu <herbert@gondor.apana.org.au> Date: Wed, 14 Jan 2009 16:35:34 +1100 > ipv6: Fix fib6_dump_table walker leak > > When a fib6 table dump is prematurely ended, we won't unlink > its walker from the list. This causes all sorts of grief for > other users of the list later. > > Reported-by: Chris Caputo <ccaputo@alt.net> > Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Applied and queued up for -stable, thanks for fixing this bug Herbert. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c index 29c7c99..52ee1dc 100644 --- a/net/ipv6/ip6_fib.c +++ b/net/ipv6/ip6_fib.c @@ -298,6 +298,10 @@ static void fib6_dump_end(struct netlink_callback *cb) struct fib6_walker_t *w = (void*)cb->args[2]; if (w) { + if (cb->args[4]) { + cb->args[4] = 0; + fib6_walker_unlink(w); + } cb->args[2] = 0; kfree(w); } @@ -330,15 +334,12 @@ static int fib6_dump_table(struct fib6_table *table, struct sk_buff *skb, read_lock_bh(&table->tb6_lock); res = fib6_walk_continue(w); read_unlock_bh(&table->tb6_lock); - if (res != 0) { - if (res < 0) - fib6_walker_unlink(w); - goto end; + if (res <= 0) { + fib6_walker_unlink(w); + cb->args[4] = 0; } - fib6_walker_unlink(w); - cb->args[4] = 0; } -end: + return res; }