From: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Date: Tue, 3 Jun 2008 16:30:25 +0000 (+0900)
Subject: [IPV6] UDP: Possible dst leak in udpv6_sendmsg.
X-Git-Tag: v2.6.26-rc5~1^2~12^2~11
X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a3c960899e042bc1c2b730a2115fa32da7802039;p=linux-2.6

[IPV6] UDP: Possible dst leak in udpv6_sendmsg.

ip6_sk_dst_lookup returns held dst entry. It should be released
on all paths beyond this point. Add missed release when up->pending
is set.

Bug report and initial patch by Denis V. Lunev <den@openvz.org>.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Acked-by: Denis V. Lunev <den@openvz.org>
---

diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 1fd784f3e2..47123bf5eb 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -848,12 +848,14 @@ do_append_data:
 		} else {
 			dst_release(dst);
 		}
+		dst = NULL;
 	}
 
 	if (err > 0)
 		err = np->recverr ? net_xmit_errno(err) : 0;
 	release_sock(sk);
 out:
+	dst_release(dst);
 	fl6_sock_release(flowlabel);
 	if (!err)
 		return len;