• Kuniyuki Iwashima's avatar
    udp: Call inet6_destroy_sock() in setsockopt(IPV6_ADDRFORM). · 21985f43
    Kuniyuki Iwashima authored
    Commit 4b340ae2 ("IPv6: Complete IPV6_DONTFRAG support") forgot
    to add a change to free inet6_sk(sk)->rxpmtu while converting an IPv6
    socket into IPv4 with IPV6_ADDRFORM.  After conversion, sk_prot is
    changed to udp_prot and ->destroy() never cleans it up, resulting in
    a memory leak.
    
    This is due to the discrepancy between inet6_destroy_sock() and
    IPV6_ADDRFORM, so let's call inet6_destroy_sock() from IPV6_ADDRFORM
    to remove the difference.
    
    However, this is not enough for now because rxpmtu can be changed
    without lock_sock() after commit 03485f2a ("udpv6: Add lockless
    sendmsg() support").  We will fix this case in the following patch.
    
    Note we will rename inet6_destroy_sock() to inet6_cleanup_sock() and
    remove unnecessary inet6_destroy_sock() calls in sk_prot->destroy()
    in the future.
    
    Fixes: 4b340ae2 ("IPv6: Complete IPV6_DONTFRAG support")
    Signed-off-by: default avatarKuniyuki Iwashima <kuniyu@amazon.com>
    Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
    21985f43
af_inet6.c 31.6 KB