summaryrefslogtreecommitdiff
path: root/net/ipv6
diff options
context:
space:
mode:
authorXin Xiong <xiongx18@fudan.edu.cn>2022-08-13 15:49:08 +0300
committerDavid S. Miller <davem@davemloft.net>2022-08-15 13:40:28 +0300
commit7396ba87f1edf549284869451665c7c4e74ecd4f (patch)
treee5a72a34df9286b9cae985c720a32398b8450a4d /net/ipv6
parent27b8d4d7a0cf442b7a0351fecc33b714f4208324 (diff)
downloadlinux-7396ba87f1edf549284869451665c7c4e74ecd4f.tar.xz
net: fix potential refcount leak in ndisc_router_discovery()
The issue happens on specific paths in the function. After both the object `rt` and `neigh` are grabbed successfully, when `lifetime` is nonzero but the metric needs change, the function just deletes the route and set `rt` to NULL. Then, it may try grabbing `rt` and `neigh` again if above conditions hold. The function simply overwrite `neigh` if succeeds or returns if fails, without decreasing the reference count of previous `neigh`. This may result in memory leaks. Fix it by decrementing the reference count of `neigh` in place. Fixes: 6b2e04bc240f ("net: allow user to set metric on default route learned via Router Advertisement") Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn> Signed-off-by: Xin Tan <tanxin.ctf@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv6')
-rw-r--r--net/ipv6/ndisc.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 98453693e400..3a553494ff16 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1378,6 +1378,9 @@ static void ndisc_router_discovery(struct sk_buff *skb)
if (!rt && lifetime) {
ND_PRINTK(3, info, "RA: adding default router\n");
+ if (neigh)
+ neigh_release(neigh);
+
rt = rt6_add_dflt_router(net, &ipv6_hdr(skb)->saddr,
skb->dev, pref, defrtr_usr_metric);
if (!rt) {