From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:60601 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755775AbcIUIF5 (ORCPT ); Wed, 21 Sep 2016 04:05:57 -0400 Subject: Patch "ipv6: release dst in ping_v6_sendmsg" has been added to the 4.7-stable tree To: davej@codemonkey.org.uk, davem@davemloft.net, gregkh@linuxfoundation.org, kafai@fb.com Cc: , From: Date: Wed, 21 Sep 2016 10:05:44 +0200 Message-ID: <1474445144138199@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled ipv6: release dst in ping_v6_sendmsg to the 4.7-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: ipv6-release-dst-in-ping_v6_sendmsg.patch and it can be found in the queue-4.7 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From foo@baz Wed Sep 21 10:05:18 CEST 2016 From: Dave Jones Date: Fri, 2 Sep 2016 14:39:50 -0400 Subject: ipv6: release dst in ping_v6_sendmsg From: Dave Jones [ Upstream commit 03c2778a938aaba0893f6d6cdc29511d91a79848 ] Neither the failure or success paths of ping_v6_sendmsg release the dst it acquires. This leads to a flood of warnings from "net/core/dst.c:288 dst_release" on older kernels that don't have 8bf4ada2e21378816b28205427ee6b0e1ca4c5f1 backported. That patch optimistically hoped this had been fixed post 3.10, but it seems at least one case wasn't, where I've seen this triggered a lot from machines doing unprivileged icmp sockets. Cc: Martin Lau Signed-off-by: Dave Jones Acked-by: Martin KaFai Lau Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/ipv6/ping.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) --- a/net/ipv6/ping.c +++ b/net/ipv6/ping.c @@ -122,8 +122,10 @@ static int ping_v6_sendmsg(struct sock * rt = (struct rt6_info *) dst; np = inet6_sk(sk); - if (!np) - return -EBADF; + if (!np) { + err = -EBADF; + goto dst_err_out; + } if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr)) fl6.flowi6_oif = np->mcast_oif; @@ -160,6 +162,9 @@ static int ping_v6_sendmsg(struct sock * } release_sock(sk); +dst_err_out: + dst_release(dst); + if (err) return err; Patches currently in stable-queue which might be from davej@codemonkey.org.uk are queue-4.7/ipv6-release-dst-in-ping_v6_sendmsg.patch