Commit a3c96089 authored by YOSHIFUJI Hideaki's avatar YOSHIFUJI Hideaki

[IPV6] UDP: Possible dst leak in udpv6_sendmsg.

ip6_sk_dst_lookup returns held dst entry. It should be released
on all paths beyond this point. Add missed release when up->pending
is set.

Bug report and initial patch by Denis V. Lunev <den@openvz.org>.
Signed-off-by: default avatarYOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Acked-by: default avatarDenis V. Lunev <den@openvz.org>
parent e5117101
...@@ -848,12 +848,14 @@ int udpv6_sendmsg(struct kiocb *iocb, struct sock *sk, ...@@ -848,12 +848,14 @@ int udpv6_sendmsg(struct kiocb *iocb, struct sock *sk,
} else { } else {
dst_release(dst); dst_release(dst);
} }
dst = NULL;
} }
if (err > 0) if (err > 0)
err = np->recverr ? net_xmit_errno(err) : 0; err = np->recverr ? net_xmit_errno(err) : 0;
release_sock(sk); release_sock(sk);
out: out:
dst_release(dst);
fl6_sock_release(flowlabel); fl6_sock_release(flowlabel);
if (!err) if (!err)
return len; return len;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment