lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[IPV6]: Fix dangling references on error in fib6_add().

Browse Source 
Fixes bugzilla #8895

If a super-tree leaf has 'rt' assigned to it and we
get an error from fib6_add_rt2node(), we'll leave
a reference to 'rt' in pn->leaf and then do an
unconditional dst_free().

We should prune such references.

Based upon a report by Vincent Perrier.

Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
David S. Miller
2008-04-18 01:46:19 -07:00
parent 1e42198609
commit 3c051235a7
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
net/ipv6/ip6_fib.c
View File

@@ -772,6 +772,10 @@ out:
* If fib6_add_1 has cleared the old leaf pointer in the * If fib6_add_1 has cleared the old leaf pointer in the
* super-tree leaf node we have to find a new one for it. * super-tree leaf node we have to find a new one for it.
*/ */
if (pn != fn && pn->leaf == rt) {
pn->leaf = NULL;
atomic_dec(&rt->rt6i_ref);
}
if (pn != fn && !pn->leaf && !(pn->fn_flags & RTN_RTINFO)) { if (pn != fn && !pn->leaf && !(pn->fn_flags & RTN_RTINFO)) {
pn->leaf = fib6_find_prefix(info->nl_net, pn); pn->leaf = fib6_find_prefix(info->nl_net, pn);
#if RT6_DEBUG >= 2 #if RT6_DEBUG >= 2