From mboxrd@z Thu Jan 1 00:00:00 1970 From: Xin Long Subject: Re: [PATCH net v3] sctp: fix dst refcnt leak in sctp_v4_get_dst Date: Tue, 6 Feb 2018 13:06:04 +0800 Message-ID: References: <20180205194814.14006-1-tommi.t.rantala@nokia.com> Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Cc: Tommi Rantala , network dev , linux-sctp@vger.kernel.org, Neil Horman , Alexey Kodanev , Marcelo Ricardo Leitner , Dmitry Vyukov To: David Ahern Return-path: Received: from mail-qk0-f176.google.com ([209.85.220.176]:44478 "EHLO mail-qk0-f176.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750758AbeBFFGF (ORCPT ); Tue, 6 Feb 2018 00:06:05 -0500 In-Reply-To: Sender: netdev-owner@vger.kernel.org List-ID: On Tue, Feb 6, 2018 at 7:20 AM, David Ahern wrote: > On 2/5/18 12:48 PM, Tommi Rantala wrote: >> Fix dst reference count leak in sctp_v4_get_dst() introduced in commit >> 410f03831 ("sctp: add routing output fallback"): >> >> When walking the address_list, successive ip_route_output_key() calls >> may return the same rt->dst with the reference incremented on each call. >> >> The code would not decrement the dst refcount when the dst pointer was >> identical from the previous iteration, causing the dst refcnt leak. >> > ... >> ... >> >> Fixes: 410f03831 ("sctp: add routing output fallback") >> Fixes: 0ca50d12f ("sctp: fix src address selection if using secondary addresses") > > any syzbot references for this bug? In Dmitry Vyukov mail, there was no syzbot reference provided. Not sure if there's another way to tell syzbot. > -- > To unsubscribe from this list: send the line "unsubscribe linux-sctp" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html From mboxrd@z Thu Jan 1 00:00:00 1970 From: Xin Long Date: Tue, 06 Feb 2018 05:06:04 +0000 Subject: Re: [PATCH net v3] sctp: fix dst refcnt leak in sctp_v4_get_dst Message-Id: List-Id: References: <20180205194814.14006-1-tommi.t.rantala@nokia.com> In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: David Ahern Cc: Tommi Rantala , network dev , linux-sctp@vger.kernel.org, Neil Horman , Alexey Kodanev , Marcelo Ricardo Leitner , Dmitry Vyukov On Tue, Feb 6, 2018 at 7:20 AM, David Ahern wrote: > On 2/5/18 12:48 PM, Tommi Rantala wrote: >> Fix dst reference count leak in sctp_v4_get_dst() introduced in commit >> 410f03831 ("sctp: add routing output fallback"): >> >> When walking the address_list, successive ip_route_output_key() calls >> may return the same rt->dst with the reference incremented on each call. >> >> The code would not decrement the dst refcount when the dst pointer was >> identical from the previous iteration, causing the dst refcnt leak. >> > ... >> ... >> >> Fixes: 410f03831 ("sctp: add routing output fallback") >> Fixes: 0ca50d12f ("sctp: fix src address selection if using secondary addresses") > > any syzbot references for this bug? In Dmitry Vyukov mail, there was no syzbot reference provided. Not sure if there's another way to tell syzbot. > -- > To unsubscribe from this list: send the line "unsubscribe linux-sctp" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html