diff options
| author | Xin Xiong <xiongx18@fudan.edu.cn> | 2022-08-13 20:49:08 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-08-25 11:40:24 +0200 |
| commit | ffb15594433391fd7885eb88ce5a7f7bdeefbb15 (patch) | |
| tree | 126c915b07f6105adc4068801f2cf705426f60dc /net/ipv6 | |
| parent | c7118a579106e4b1a81727933e1fd51829e03210 (diff) | |
| download | linux-stable-ffb15594433391fd7885eb88ce5a7f7bdeefbb15.tar.gz linux-stable-ffb15594433391fd7885eb88ce5a7f7bdeefbb15.tar.bz2 linux-stable-ffb15594433391fd7885eb88ce5a7f7bdeefbb15.zip | |
net: fix potential refcount leak in ndisc_router_discovery()
commit 7396ba87f1edf549284869451665c7c4e74ecd4f upstream.
The issue happens on specific paths in the function. After both the
object `rt` and `neigh` are grabbed successfully, when `lifetime` is
nonzero but the metric needs change, the function just deletes the
route and set `rt` to NULL. Then, it may try grabbing `rt` and `neigh`
again if above conditions hold. The function simply overwrite `neigh`
if succeeds or returns if fails, without decreasing the reference
count of previous `neigh`. This may result in memory leaks.
Fix it by decrementing the reference count of `neigh` in place.
Fixes: 6b2e04bc240f ("net: allow user to set metric on default route learned via Router Advertisement")
Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn>
Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/ipv6')
| -rw-r--r-- | net/ipv6/ndisc.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c index 4b098521a44c..8108e9a941d0 100644 --- a/net/ipv6/ndisc.c +++ b/net/ipv6/ndisc.c @@ -1317,6 +1317,9 @@ static void ndisc_router_discovery(struct sk_buff *skb) if (!rt && lifetime) { ND_PRINTK(3, info, "RA: adding default router\n"); + if (neigh) + neigh_release(neigh); + rt = rt6_add_dflt_router(net, &ipv6_hdr(skb)->saddr, skb->dev, pref, defrtr_usr_metric); if (!rt) { |