This is a note to let you know that I've just added the patch titled
ipv6: fix a dst leak when removing its exception
to the 4.19-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
ipv6-fix-a-dst-leak-when-removing-its-exception.patch
and it can be found in the queue-4.19 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From foo@baz Wed Nov 21 12:16:27 CET 2018
From: Xin Long <lucien.xin@xxxxxxxxx>
Date: Wed, 14 Nov 2018 00:48:28 +0800
Subject: ipv6: fix a dst leak when removing its exception
From: Xin Long <lucien.xin@xxxxxxxxx>
[ Upstream commit 761f60261b4401aa368d71d431b4c218af0efcee ]
These is no need to hold dst before calling rt6_remove_exception_rt().
The call to dst_hold_safe() in ip6_link_failure() was for ip6_del_rt(),
which has been removed in Commit 93531c674315 ("net/ipv6: separate
handling of FIB entries from dst based routes"). Otherwise, it will
cause a dst leak.
This patch is to simply remove the dst_hold_safe() call before calling
rt6_remove_exception_rt() and also do the same in ip6_del_cached_rt().
It's safe, because the removal of the exception that holds its dst's
refcnt is protected by rt6_exception_lock.
Fixes: 93531c674315 ("net/ipv6: separate handling of FIB entries from dst based routes")
Fixes: 23fb93a4d3f1 ("net/ipv6: Cleanup exception and cache route handling")
Reported-by: Li Shuang <shuali@xxxxxxxxxx>
Signed-off-by: Xin Long <lucien.xin@xxxxxxxxx>
Reviewed-by: David Ahern <dsahern@xxxxxxxxx>
Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/ipv6/route.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2263,8 +2263,7 @@ static void ip6_link_failure(struct sk_b
if (rt) {
rcu_read_lock();
if (rt->rt6i_flags & RTF_CACHE) {
- if (dst_hold_safe(&rt->dst))
- rt6_remove_exception_rt(rt);
+ rt6_remove_exception_rt(rt);
} else {
struct fib6_info *from;
struct fib6_node *fn;
@@ -3266,8 +3265,8 @@ static int ip6_del_cached_rt(struct rt6_
if (cfg->fc_flags & RTF_GATEWAY &&
!ipv6_addr_equal(&cfg->fc_gateway, &rt->rt6i_gateway))
goto out;
- if (dst_hold_safe(&rt->dst))
- rc = rt6_remove_exception_rt(rt);
+
+ rc = rt6_remove_exception_rt(rt);
out:
return rc;
}
Patches currently in stable-queue which might be from lucien.xin@xxxxxxxxx are
queue-4.19/ipv6-fix-a-dst-leak-when-removing-its-exception.patch
queue-4.19/sctp-not-allow-to-set-asoc-prsctp_enable-by-sockopt.patch
queue-4.19/l2tp-fix-a-sock-refcnt-leak-in-l2tp_tunnel_register.patch
queue-4.19/revert-sctp-remove-sctp_transport_pmtu_check.patch
queue-4.19/sctp-not-increase-stream-s-incnt-before-sending-addstrm_in-request.patch
queue-4.19/sctp-define-sctp_ss_default-for-stream-schedulers.patch
queue-4.19/sctp-fix-strchange_flags-name-for-stream-change-event.patch
