* [PATCH] net: fix potential refcount leak in ndisc_router_discovery()
@ 2022-08-13 12:49 Xin Xiong
2022-08-15 10:50 ` patchwork-bot+netdevbpf
2022-08-15 18:03 ` Praveen Chaudhary
0 siblings, 2 replies; 3+ messages in thread
From: Xin Xiong @ 2022-08-13 12:49 UTC (permalink / raw
To: David S. Miller, Hideaki YOSHIFUJI, David Ahern, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Praveen Chaudhary, Zhenggen Xu,
netdev, linux-kernel
Cc: yuanxzhang, Xin Xiong, Xin Tan
The issue happens on specific paths in the function. After both the
object `rt` and `neigh` are grabbed successfully, when `lifetime` is
nonzero but the metric needs change, the function just deletes the
route and set `rt` to NULL. Then, it may try grabbing `rt` and `neigh`
again if above conditions hold. The function simply overwrite `neigh`
if succeeds or returns if fails, without decreasing the reference
count of previous `neigh`. This may result in memory leaks.
Fix it by decrementing the reference count of `neigh` in place.
Fixes: 6b2e04bc240f ("net: allow user to set metric on default route learned via Router Advertisement")
Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn>
Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
---
net/ipv6/ndisc.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 98453693e400..3a553494ff16 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1378,6 +1378,9 @@ static void ndisc_router_discovery(struct sk_buff *skb)
if (!rt && lifetime) {
ND_PRINTK(3, info, "RA: adding default router\n");
+ if (neigh)
+ neigh_release(neigh);
+
rt = rt6_add_dflt_router(net, &ipv6_hdr(skb)->saddr,
skb->dev, pref, defrtr_usr_metric);
if (!rt) {
--
2.25.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] net: fix potential refcount leak in ndisc_router_discovery()
2022-08-13 12:49 [PATCH] net: fix potential refcount leak in ndisc_router_discovery() Xin Xiong
@ 2022-08-15 10:50 ` patchwork-bot+netdevbpf
2022-08-15 18:03 ` Praveen Chaudhary
1 sibling, 0 replies; 3+ messages in thread
From: patchwork-bot+netdevbpf @ 2022-08-15 10:50 UTC (permalink / raw
To: Xin Xiong
Cc: davem, yoshfuji, dsahern, edumazet, kuba, pabeni, praveen5582,
zxu, netdev, linux-kernel, yuanxzhang, tanxin.ctf
Hello:
This patch was applied to netdev/net.git (master)
by David S. Miller <davem@davemloft.net>:
On Sat, 13 Aug 2022 20:49:08 +0800 you wrote:
> The issue happens on specific paths in the function. After both the
> object `rt` and `neigh` are grabbed successfully, when `lifetime` is
> nonzero but the metric needs change, the function just deletes the
> route and set `rt` to NULL. Then, it may try grabbing `rt` and `neigh`
> again if above conditions hold. The function simply overwrite `neigh`
> if succeeds or returns if fails, without decreasing the reference
> count of previous `neigh`. This may result in memory leaks.
>
> [...]
Here is the summary with links:
- net: fix potential refcount leak in ndisc_router_discovery()
https://git.kernel.org/netdev/net/c/7396ba87f1ed
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 3+ messages in thread
* RE: [PATCH] net: fix potential refcount leak in ndisc_router_discovery()
2022-08-13 12:49 [PATCH] net: fix potential refcount leak in ndisc_router_discovery() Xin Xiong
2022-08-15 10:50 ` patchwork-bot+netdevbpf
@ 2022-08-15 18:03 ` Praveen Chaudhary
1 sibling, 0 replies; 3+ messages in thread
From: Praveen Chaudhary @ 2022-08-15 18:03 UTC (permalink / raw
To: David S. Miller, Hideaki YOSHIFUJI, David Ahern, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Praveen Chaudhary, Zhenggen Xu,
netdev, linux-kernel
Hi Xin
Any reason why you are not adding this code under the
if (rt && (lifetime == 0 || rt->fib6_metric != defrtr_usr_metric)) block ?
i.e. while route deletion.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-08-15 18:03 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-08-13 12:49 [PATCH] net: fix potential refcount leak in ndisc_router_discovery() Xin Xiong
2022-08-15 10:50 ` patchwork-bot+netdevbpf
2022-08-15 18:03 ` Praveen Chaudhary
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).