Commit 03c2778a authored Sep 02, 2016 by Dave Jones Committed by David S. Miller Sep 06, 2016

ipv6: release dst in ping_v6_sendmsg



Neither the failure or success paths of ping_v6_sendmsg release
the dst it acquires.  This leads to a flood of warnings from
"net/core/dst.c:288 dst_release" on older kernels that
don't have 8bf4ada2 backported.

That patch optimistically hoped this had been fixed post 3.10, but
it seems at least one case wasn't, where I've seen this triggered
a lot from machines doing unprivileged icmp sockets.

Cc: Martin Lau <kafai@fb.com>
Signed-off-by: Dave Jones <davej@codemonkey.org.uk>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 6e1ce3c3

net/ipv6/ping.c

+7 −2

Original line number	Diff line number	Diff line
		@@ -126,8 +126,10 @@ static int ping_v6_sendmsg(struct sock sk, struct msghdr msg, size_t len)
		rt = (struct rt6_info *) dst;

		np = inet6_sk(sk);
		if (!np)
		return -EBADF;
		if (!np) {
		err = -EBADF;
		goto dst_err_out;
		}

		if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
		fl6.flowi6_oif = np->mcast_oif;
		@@ -163,6 +165,9 @@ static int ping_v6_sendmsg(struct sock sk, struct msghdr msg, size_t len)
		}
		release_sock(sk);

		dst_err_out:
		dst_release(dst);

		if (err)
		return err;