Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757132AbZCZMwY (ORCPT ); Thu, 26 Mar 2009 08:52:24 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1753476AbZCZMwM (ORCPT ); Thu, 26 Mar 2009 08:52:12 -0400 Received: from miranda.se.axis.com ([193.13.178.8]:56825 "EHLO miranda.se.axis.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752669AbZCZMwL (ORCPT ); Thu, 26 Mar 2009 08:52:11 -0400 X-Greylist: delayed 784 seconds by postgrey-1.27 at vger.kernel.org; Thu, 26 Mar 2009 08:52:10 EDT Date: Thu, 26 Mar 2009 13:38:53 +0100 From: Jesper Nilsson To: YOSHIFUJI Hideaki , netdev@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Mikael Starvik Subject: ipv6: Plug sk_buff leak in ipv6_rcv (net/ipv6/ip6_input.c) Message-ID: <20090326123853.GW31562@axis.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.18 (2008-05-17) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1816 Lines: 56 Hi, Commit 778d80be52699596bf70e0eb0761cf5e1e46088d (ipv6: Add disable_ipv6 sysctl to disable IPv6 operaion on specific interface) seems to have introduced a leak of sk_buff's for ipv6 traffic, at least in some configurations where idev is NULL, or when ipv6 is disabled via sysctl. The problem is that if the first condition of the if-statement returns non-NULL, it returns an skb with only one reference, and when the other conditions apply, execution jumps to the "out" label, which does not call kfree_skb for it. To plug this leak, change to use the "drop" label instead. (this relies on it being ok to call kfree_skb on NULL) This also allows us to avoid calling rcu_read_unlock here, and removes the only user of the "out" label. Signed-off-by: Jesper Nilsson --- ip6_input.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c index f171e8d..8f04bd9 100644 --- a/net/ipv6/ip6_input.c +++ b/net/ipv6/ip6_input.c @@ -75,8 +75,7 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL || !idev || unlikely(idev->cnf.disable_ipv6)) { IP6_INC_STATS_BH(net, idev, IPSTATS_MIB_INDISCARDS); - rcu_read_unlock(); - goto out; + goto drop; } memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm)); @@ -147,7 +146,6 @@ err: drop: rcu_read_unlock(); kfree_skb(skb); -out: return 0; } /^JN - Jesper Nilsson -- Jesper Nilsson -- jesper.nilsson@axis.com -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/