Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3c051235 authored by David S. Miller's avatar David S. Miller
Browse files

[IPV6]: Fix dangling references on error in fib6_add(). 



Fixes bugzilla #8895

If a super-tree leaf has 'rt' assigned to it and we
get an error from fib6_add_rt2node(), we'll leave
a reference to 'rt' in pn->leaf and then do an
unconditional dst_free().

We should prune such references.

Based upon a report by Vincent Perrier.

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 1e421986

net/ipv6/ip6_fib.c

+4 −0
Original line number Diff line number Diff line
@@ -772,6 +772,10 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt, struct nl_info *info) 
		 * If fib6_add_1 has cleared the old leaf pointer in the

		 * super-tree leaf node we have to find a new one for it.

		 */

		if (pn != fn && pn->leaf == rt) {

			pn->leaf = NULL;

			atomic_dec(&rt->rt6i_ref);

		}

		if (pn != fn && !pn->leaf && !(pn->fn_flags & RTN_RTINFO)) {

			pn->leaf = fib6_find_prefix(info->nl_net, pn);

#if RT6_DEBUG >= 2