Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 897dc80b authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

ipv6: avoid a dst_entry refcount change in ipv6_destopt_rcv() 



ipv6_destopt_rcv() runs with rcu_read_lock(), so there is no need to
take a temporay reference on dst_entry, even if skb is freed by
ip6_parse_tlv()

Signed-off-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent d14730b8

net/ipv6/exthdrs.c

+2 −5
Original line number Diff line number Diff line
@@ -273,12 +273,12 @@ static int ipv6_destopt_rcv(struct sk_buff *skb) 
#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)

	__u16 dstbuf;

#endif

	struct dst_entry *dst;

	struct dst_entry *dst = skb_dst(skb);



	if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||

	    !pskb_may_pull(skb, (skb_transport_offset(skb) +

				 ((skb_transport_header(skb)[1] + 1) << 3)))) {

		IP6_INC_STATS_BH(dev_net(skb_dst(skb)->dev), ip6_dst_idev(skb_dst(skb)),

		IP6_INC_STATS_BH(dev_net(dst->dev), ip6_dst_idev(dst),

				 IPSTATS_MIB_INHDRERRORS);

		kfree_skb(skb);

		return -1;
@@ -289,9 +289,7 @@ static int ipv6_destopt_rcv(struct sk_buff *skb) 
	dstbuf = opt->dst1;

#endif



	dst = dst_clone(skb_dst(skb));

	if (ip6_parse_tlv(tlvprocdestopt_lst, skb)) {

		dst_release(dst);

		skb->transport_header += (skb_transport_header(skb)[1] + 1) << 3;

		opt = IP6CB(skb);

#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
@@ -304,7 +302,6 @@ static int ipv6_destopt_rcv(struct sk_buff *skb) 


	IP6_INC_STATS_BH(dev_net(dst->dev),

			 ip6_dst_idev(dst), IPSTATS_MIB_INHDRERRORS);

	dst_release(dst);

	return -1;

}