Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

ipv4: fix reply_dst leakage on arp reply

Browse source 
There are cases when the created metadata reply is not used. Ensure the
allocated memory is freed also in such cases.

Fixes: 63d008a4e9 ("ipv4: send arp replies to the correct tunnel")
Reported-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: Jiri Benc <jbenc@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Jiri Benc 2015-10-01 16:25:43 +02:00 • committed by David S. Miller
parent 2306c704ce
commit 181a4224ac
1 changed files with 5 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
net/ipv4/arp.c
View file

@ -312,7 +312,7 @@ static void arp_send_dst(int type, int ptype, __be32 dest_ip,
if (!skb) if (!skb)
return; return;
skb_dst_set(skb, dst); skb_dst_set(skb, dst_clone(dst));
arp_xmit(skb); arp_xmit(skb);
} }
@ -384,7 +384,7 @@ static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb)
} }
if (skb && !(dev->priv_flags & IFF_XMIT_DST_RELEASE)) if (skb && !(dev->priv_flags & IFF_XMIT_DST_RELEASE))
dst = dst_clone(skb_dst(skb)); dst = skb_dst(skb);
arp_send_dst(ARPOP_REQUEST, ETH_P_ARP, target, dev, saddr, arp_send_dst(ARPOP_REQUEST, ETH_P_ARP, target, dev, saddr,
dst_hw, dev->dev_addr, NULL, dst); dst_hw, dev->dev_addr, NULL, dst);
} }
@ -811,7 +811,7 @@ static int arp_process(struct sock *sk, struct sk_buff *skb)
} else { } else {
pneigh_enqueue(&arp_tbl, pneigh_enqueue(&arp_tbl,
in_dev->arp_parms, skb); in_dev->arp_parms, skb);
return 0; goto out_free_dst;
} }
goto out; goto out;
} }
@ -865,6 +865,8 @@ static int arp_process(struct sock *sk, struct sk_buff *skb)
out: out:
consume_skb(skb); consume_skb(skb);
out_free_dst:
dst_release(reply_dst);
return 0; return 0;
} }