Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a3c96089 authored by YOSHIFUJI Hideaki's avatar YOSHIFUJI Hideaki
Browse files

[IPV6] UDP: Possible dst leak in udpv6_sendmsg. 



ip6_sk_dst_lookup returns held dst entry. It should be released
on all paths beyond this point. Add missed release when up->pending
is set.

Bug report and initial patch by Denis V. Lunev <den@openvz.org>.

Signed-off-by: default avatarYOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Acked-by: default avatarDenis V. Lunev <den@openvz.org>
parent e5117101

net/ipv6/udp.c

+2 −0
Original line number Original line Diff line number Diff line
@@ -848,12 +848,14 @@ int udpv6_sendmsg(struct kiocb *iocb, struct sock *sk, 
		} else {

		} else {

			dst_release(dst);

			dst_release(dst);

		}

		}

		dst = NULL;

	}

	}





	if (err > 0)

	if (err > 0)

		err = np->recverr ? net_xmit_errno(err) : 0;

		err = np->recverr ? net_xmit_errno(err) : 0;

	release_sock(sk);

	release_sock(sk);

out:

out:

	dst_release(dst);

	fl6_sock_release(flowlabel);

	fl6_sock_release(flowlabel);

	if (!err)

	if (!err)

		return len;

		return len;