From mboxrd@z Thu Jan 1 00:00:00 1970 From: Marcelo Ricardo Leitner Subject: Re: [PATCH] sctp: fix dst refcnt leak in sctp_v6_get_dst() Date: Mon, 5 Feb 2018 13:53:49 -0200 Message-ID: <20180205155349.GC27685@localhost.localdomain> References: <1517832635-18376-1-git-send-email-alexey.kodanev@oracle.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: netdev@vger.kernel.org, Xin Long , Tommi Rantala , Neil Horman , Vlad Yasevich , David Miller , linux-sctp@vger.kernel.org To: Alexey Kodanev Return-path: Received: from mail-qk0-f194.google.com ([209.85.220.194]:43797 "EHLO mail-qk0-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752972AbeBEPxw (ORCPT ); Mon, 5 Feb 2018 10:53:52 -0500 Content-Disposition: inline In-Reply-To: <1517832635-18376-1-git-send-email-alexey.kodanev@oracle.com> Sender: netdev-owner@vger.kernel.org List-ID: On Mon, Feb 05, 2018 at 03:10:35PM +0300, Alexey Kodanev wrote: > When going through the bind address list in sctp_v6_get_dst() and > the previously found address is better ('matchlen > bmatchlen'), > the code continues to the next iteration without releasing currently > held destination. > > Fix it by releasing 'bdst' before continue to the next iteration, and > instead of introducing one more '!IS_ERR(bdst)' check for dst_release(), > move the already existed one right after ip6_dst_lookup_flow(), i.e. we > shouldn't proceed further if we get an error for the route lookup. > > Fixes: dbc2b5e9a09e ("sctp: fix src address selection if using secondary addresses for ipv6") > Signed-off-by: Alexey Kodanev Acked-by: Marcelo Ricardo Leitner > --- > net/sctp/ipv6.c | 10 +++++++--- > 1 files changed, 7 insertions(+), 3 deletions(-) > > diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c > index 5d4c15b..e35d4f7 100644 > --- a/net/sctp/ipv6.c > +++ b/net/sctp/ipv6.c > @@ -326,8 +326,10 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr, > final_p = fl6_update_dst(fl6, rcu_dereference(np->opt), &final); > bdst = ip6_dst_lookup_flow(sk, fl6, final_p); > > - if (!IS_ERR(bdst) && > - ipv6_chk_addr(dev_net(bdst->dev), > + if (IS_ERR(bdst)) > + continue; > + > + if (ipv6_chk_addr(dev_net(bdst->dev), > &laddr->a.v6.sin6_addr, bdst->dev, 1)) { > if (!IS_ERR_OR_NULL(dst)) > dst_release(dst); > @@ -336,8 +338,10 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr, > } > > bmatchlen = sctp_v6_addr_match_len(daddr, &laddr->a); > - if (matchlen > bmatchlen) > + if (matchlen > bmatchlen) { > + dst_release(bdst); > continue; > + } > > if (!IS_ERR_OR_NULL(dst)) > dst_release(dst); > -- > 1.7.1 > > -- > To unsubscribe from this list: send the line "unsubscribe linux-sctp" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html >