Commit 4062090e authored by Vasily Averin's avatar Vasily Averin Committed by David S. Miller
Browse files

ipv4: dst_entry leak in ip_send_unicast_reply() 



ip_setup_cork() called inside ip_append_data() steals dst entry from rt to cork
and in case errors in __ip_append_data() nobody frees stolen dst entry

Fixes: 2e77d89b ("net: avoid a pair of dst_hold()/dst_release() in ip_append_data()")
Signed-off-by: default avatarVasily Averin <vvs@parallels.com>
Acked-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 461b74c3

net/ipv4/ip_output.c

+9 −3
Original line number Diff line number Diff line
@@ -1535,6 +1535,7 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, 
	struct sk_buff *nskb;

	struct sock *sk;

	struct inet_sock *inet;

	int err;



	if (__ip_options_echo(&replyopts.opt.opt, skb, sopt))

		return;
@@ -1574,8 +1575,13 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, 
	sock_net_set(sk, net);

	__skb_queue_head_init(&sk->sk_write_queue);

	sk->sk_sndbuf = sysctl_wmem_default;

	ip_append_data(sk, &fl4, ip_reply_glue_bits, arg->iov->iov_base, len, 0,

		       &ipc, &rt, MSG_DONTWAIT);

	err = ip_append_data(sk, &fl4, ip_reply_glue_bits, arg->iov->iov_base,

			     len, 0, &ipc, &rt, MSG_DONTWAIT);

	if (unlikely(err)) {

		ip_flush_pending_frames(sk);

		goto out;

	}



	nskb = skb_peek(&sk->sk_write_queue);

	if (nskb) {

		if (arg->csumoffset >= 0)
@@ -1587,7 +1593,7 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, 
		skb_set_queue_mapping(nskb, skb_get_queue_mapping(skb));

		ip_push_pending_frames(sk, &fl4);

	}



out:

	put_cpu_var(unicast_sock);



	ip_rt_put(rt);

CRA Git | Maintained and supported by SUSTech CRA and CCSE