Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 181a4224 authored by Jiri Benc's avatar Jiri Benc Committed by David S. Miller
Browse files

ipv4: fix reply_dst leakage on arp reply 



There are cases when the created metadata reply is not used. Ensure the
allocated memory is freed also in such cases.

Fixes: 63d008a4 ("ipv4: send arp replies to the correct tunnel")
Reported-by: default avatarHannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: default avatarJiri Benc <jbenc@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 2306c704

net/ipv4/arp.c

+5 −3
Original line number Diff line number Diff line
@@ -312,7 +312,7 @@ static void arp_send_dst(int type, int ptype, __be32 dest_ip, 
	if (!skb)

		return;



	skb_dst_set(skb, dst);

	skb_dst_set(skb, dst_clone(dst));

	arp_xmit(skb);

}
@@ -384,7 +384,7 @@ static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb) 
	}



	if (skb && !(dev->priv_flags & IFF_XMIT_DST_RELEASE))

		dst = dst_clone(skb_dst(skb));

		dst = skb_dst(skb);

	arp_send_dst(ARPOP_REQUEST, ETH_P_ARP, target, dev, saddr,

		     dst_hw, dev->dev_addr, NULL, dst);

}
@@ -811,7 +811,7 @@ static int arp_process(struct sock *sk, struct sk_buff *skb) 
				} else {

					pneigh_enqueue(&arp_tbl,

						       in_dev->arp_parms, skb);

					return 0;

					goto out_free_dst;

				}

				goto out;

			}
@@ -865,6 +865,8 @@ static int arp_process(struct sock *sk, struct sk_buff *skb) 


out:

	consume_skb(skb);

out_free_dst:

	dst_release(reply_dst);

	return 0;

}