[IPV6] Fix dst leak in ipv6_add_addr

[IPV6] Fix dst leak in ipv6_add_addr

[Herbert Xu]

[-- Attachment #1: Type: text/plain, Size: 396 bytes --]

Hi:

Found another error-path dst leak.  If the idev->dead check is
triggered in ipv6_add_addr the rt entry will leak.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> 

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

[-- Attachment #2: p --]
[-- Type: text/plain, Size: 612 bytes --]

===== net/ipv6/addrconf.c 1.115 vs edited =====
--- 1.115/net/ipv6/addrconf.c	2004-10-26 14:11:35 +10:00
+++ edited/net/ipv6/addrconf.c	2004-11-06 15:37:54 +11:00
@@ -484,7 +484,7 @@
 	      int scope, unsigned flags)
 {
 	struct inet6_ifaddr *ifa = NULL;
-	struct rt6_info *rt;
+	struct rt6_info *rt = NULL;
 	int hash;
 	static spinlock_t lock = SPIN_LOCK_UNLOCKED;
 	int err = 0;
@@ -572,6 +572,10 @@
 	if (unlikely(err == 0))
 		notifier_call_chain(&inet6addr_chain, NETDEV_UP, ifa);
 	else {
+		if (rt) {
+			dst_release(&rt->u.dst);
+			dst_free(&rt->u.dst);
+		}
 		kfree(ifa);
 		ifa = ERR_PTR(err);
 	}

Re: [IPV6] Fix dst leak in ipv6_add_addr

[David S. Miller]

On Sat, 6 Nov 2004 15:41:21 +1100
Herbert Xu <herbert@gondor.apana.org.au> wrote:

> Found another error-path dst leak.  If the idev->dead check is
> triggered in ipv6_add_addr the rt entry will leak.

This one was fixed in the xfrm_lookup() patch I sent yesterday :-)

I guess it's good that multiple people are verifying all of
these code paths.

Re: [IPV6] Fix dst leak in ipv6_add_addr

[Herbert Xu]

On Sat, Nov 06, 2004 at 12:05:18AM -0800, David S. Miller wrote:
> On Sat, 6 Nov 2004 15:41:21 +1100
> Herbert Xu <herbert@gondor.apana.org.au> wrote:
> 
> > Found another error-path dst leak.  If the idev->dead check is
> > triggered in ipv6_add_addr the rt entry will leak.
> 
> This one was fixed in the xfrm_lookup() patch I sent yesterday :-)

Indeed, I overlooked that message :)

However your version still leaks the rt since its refcnt is set to 1.
It will also dereference an unitialised rt if allocating ifa fails.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: [IPV6] Fix dst leak in ipv6_add_addr

[David S. Miller]

On Sat, 6 Nov 2004 15:41:21 +1100
Herbert Xu <herbert@gondor.apana.org.au> wrote:

> Found another error-path dst leak.  If the idev->dead check is
> triggered in ipv6_add_addr the rt entry will leak.

Good catch, patch applied.

Thanks Herbert.