diff options
| author | Dave Jones <davej@codemonkey.org.uk> | 2016-09-02 14:39:50 -0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2016-09-24 10:09:26 +0200 |
| commit | e4a409d45cc42239dc7dc39000f758fc99e2fdec (patch) | |
| tree | 2a9104188067dfbfb2a5c817148bef34eae3588d /net | |
| parent | ae2ca992d99a7f4239ee6453e2d6ba42bac2905b (diff) | |
| download | linux-stable-e4a409d45cc42239dc7dc39000f758fc99e2fdec.tar.gz linux-stable-e4a409d45cc42239dc7dc39000f758fc99e2fdec.tar.bz2 linux-stable-e4a409d45cc42239dc7dc39000f758fc99e2fdec.zip | |
ipv6: release dst in ping_v6_sendmsg
[ Upstream commit 03c2778a938aaba0893f6d6cdc29511d91a79848 ]
Neither the failure or success paths of ping_v6_sendmsg release
the dst it acquires. This leads to a flood of warnings from
"net/core/dst.c:288 dst_release" on older kernels that
don't have 8bf4ada2e21378816b28205427ee6b0e1ca4c5f1 backported.
That patch optimistically hoped this had been fixed post 3.10, but
it seems at least one case wasn't, where I've seen this triggered
a lot from machines doing unprivileged icmp sockets.
Cc: Martin Lau <kafai@fb.com>
Signed-off-by: Dave Jones <davej@codemonkey.org.uk>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/ipv6/ping.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c index 3ee3e444a66b..408660477ba6 100644 --- a/net/ipv6/ping.c +++ b/net/ipv6/ping.c @@ -122,8 +122,10 @@ static int ping_v6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) rt = (struct rt6_info *) dst; np = inet6_sk(sk); - if (!np) - return -EBADF; + if (!np) { + err = -EBADF; + goto dst_err_out; + } if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr)) fl6.flowi6_oif = np->mcast_oif; @@ -160,6 +162,9 @@ static int ping_v6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) } release_sock(sk); +dst_err_out: + dst_release(dst); + if (err) return err; |