[PATCH] [UDPv6] Possible dst leak in udpv6_sendmsg.

[PATCH] [UDPv6] Possible dst leak in udpv6_sendmsg.

[Denis V. Lunev]

ip6_sk_dst_lookup returns held dst entry. It should be released on all paths
beyond this point. Add missed release when up->pending is set.

Signed-off-by: Denis V. Lunev <den@openvz.org>
---
 net/ipv6/udp.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 1fd784f..3235528 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -813,6 +813,7 @@ back_from_confirm:
 		/* The socket is already corked while preparing it. */
 		/* ... which is an evident application bug. --ANK */
 		release_sock(sk);
+		dst_release(dst);
 
 		LIMIT_NETDEBUG(KERN_DEBUG "udp cork app bug 2\n");
 		err = -EINVAL;
-- 
1.5.3.rc5

Re: [PATCH] [UDPv6] Possible dst leak in udpv6_sendmsg.

[YOSHIFUJI Hideaki / 吉藤英明]

In article <1212491322-9161-1-git-send-email-den@openvz.org> (at Tue,  3 Jun 2008 15:08:42 +0400), "Denis V. Lunev" <den@openvz.org> says:

> ip6_sk_dst_lookup returns held dst entry. It should be released on all paths
> beyond this point. Add missed release when up->pending is set.

Which kernel are you refering?
And, would you please take a look at ipv4 side as well?

--yoshfuji

Re: [PATCH] [UDPv6] Possible dst leak in udpv6_sendmsg.

[Denis V. Lunev]

On Tue, 2008-06-03 at 20:35 +0900, YOSHIFUJI Hideaki / 吉藤英明 wrote:
> In article <1212491322-9161-1-git-send-email-den@openvz.org> (at Tue,  3 Jun 2008 15:08:42 +0400), "Denis V. Lunev" <den@openvz.org> says:
> 
> > ip6_sk_dst_lookup returns held dst entry. It should be released on all paths
> > beyond this point. Add missed release when up->pending is set.
> 
> Which kernel are you refering?
The patch is made against current net-2.6 tree, though all kernels are
affected, starting at least RHEL5

> And, would you please take a look at ipv4 side as well?

ipv4 is ok, the code looks the same but there is an ip_rt_put at the
out: label.

Re: [PATCH] [UDPv6] Possible dst leak in udpv6_sendmsg.

[YOSHIFUJI Hideaki / 吉藤英明]

In article <1212493845.6499.29.camel@iris.sw.ru> (at Tue, 03 Jun 2008 15:50:45 +0400), "Denis V. Lunev" <den@openvz.org> says:

> On Tue, 2008-06-03 at 20:35 +0900, YOSHIFUJI Hideaki / 吉藤英明 wrote:
> > In article <1212491322-9161-1-git-send-email-den@openvz.org> (at Tue,  3 Jun 2008 15:08:42 +0400), "Denis V. Lunev" <den@openvz.org> says:
> > 
> > > ip6_sk_dst_lookup returns held dst entry. It should be released on all paths
> > > beyond this point. Add missed release when up->pending is set.
> > 
> > Which kernel are you refering?
> The patch is made against current net-2.6 tree, though all kernels are
> affected, starting at least RHEL5
> 
> > And, would you please take a look at ipv4 side as well?
> 
> ipv4 is ok, the code looks the same but there is an ip_rt_put at the
> out: label.
> 

Okay, I think we have one more leakage here (in do_confirm path).
How about this?

diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 1fd784f..47123bf 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -848,12 +848,14 @@ do_append_data:
 		} else {
 			dst_release(dst);
 		}
+		dst = NULL;
 	}
 
 	if (err > 0)
 		err = np->recverr ? net_xmit_errno(err) : 0;
 	release_sock(sk);
 out:
+	dst_release(dst);
 	fl6_sock_release(flowlabel);
 	if (!err)
 		return len;

--yoshfuji

Re: [PATCH] [UDPv6] Possible dst leak in udpv6_sendmsg.

[Denis V. Lunev]

Acked-by: Denis V. Lunev <den@openvz.org>

On Wed, 2008-06-04 at 01:26 +0900, YOSHIFUJI Hideaki / 吉藤英明 wrote:
> udp.c

Re: [PATCH] [UDPv6] Possible dst leak in udpv6_sendmsg.

[YOSHIFUJI Hideaki / 吉藤英明]

In article <1212510848.12028.0.camel@iris.sw.ru> (at Tue, 03 Jun 2008 20:34:08 +0400), "Denis V. Lunev" <den@openvz.org> says:

> Acked-by: Denis V. Lunev <den@openvz.org>

Okay, I'm queueing this for net-2.6.  Thanks.

--yoshfuji