Commit 71f6f6df authored Mar 27, 2009 by Jesper Nilsson Committed by David S. Miller Mar 27, 2009

ipv6: Plug sk_buff leak in ipv6_rcv (net/ipv6/ip6_input.c)



Commit 778d80be
(ipv6: Add disable_ipv6 sysctl to disable IPv6 operaion on specific interface)
seems to have introduced a leak of sk_buff's for ipv6 traffic,
at least in some configurations where idev is NULL, or when ipv6
is disabled via sysctl.

The problem is that if the first condition of the if-statement
returns non-NULL, it returns an skb with only one reference,
and when the other conditions apply, execution jumps to the "out"
label, which does not call kfree_skb for it.

To plug this leak, change to use the "drop" label instead.
(this relies on it being ok to call kfree_skb on NULL)
This also allows us to avoid calling rcu_read_unlock here,
and removes the only user of the "out" label.

Signed-off-by: Jesper Nilsson <jesper.nilsson@axis.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent a1702857

net/ipv6/ip6_input.c

+1 −3

Original line number	Diff line number	Diff line
		@@ -75,8 +75,7 @@ int ipv6_rcv(struct sk_buff skb, struct net_device dev, struct packet_type *pt
		if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL \|\|
		!idev \|\| unlikely(idev->cnf.disable_ipv6)) {
		IP6_INC_STATS_BH(net, idev, IPSTATS_MIB_INDISCARDS);
		rcu_read_unlock();
		goto out;
		goto drop;
		}

		memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
		@@ -147,7 +146,6 @@ err:
		drop:
		rcu_read_unlock();
		kfree_skb(skb);
		out:
		return 0;
		}