linux-kernel - [PATCH 2/2] netrom: fix reference count leak in nr_rt_device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20251204090905.28663-3-junjie.cao@intel.com>
Date: Thu,  4 Dec 2025 17:09:05 +0800
From: Junjie Cao <junjie.cao@...el.com>
To: pabeni@...hat.com,
	davem@...emloft.net,
	edumazet@...gle.com,
	kuba@...nel.org,
	syzbot+14afda08dc3484d5db82@...kaller.appspotmail.com
Cc: horms@...nel.org,
	linux-hams@...r.kernel.org,
	netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	syzkaller-bugs@...glegroups.com,
	stable@...r.kernel.org,
	junjie.cao@...el.com
Subject: [PATCH 2/2] netrom: fix reference count leak in nr_rt_device_down

When a device goes down, nr_rt_device_down() clears the routes that
use this device. However, it fails to drop the per-route reference to
the neighbour (nr_neigh): neither nr_neigh->count nor its refcount
is decremented when the route is removed.

Mirror the behaviour of nr_dec_obs() / nr_del_node() by decrementing
nr_neigh->count and calling nr_neigh_put(), so that the neighbour
reference is properly released when a device goes down.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@...r.kernel.org
Signed-off-by: Junjie Cao <junjie.cao@...el.com>
---
 net/netrom/nr_route.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c
index 20aacfdfccd4..35d10985fd7a 100644
--- a/net/netrom/nr_route.c
+++ b/net/netrom/nr_route.c
@@ -517,6 +517,9 @@ void nr_rt_device_down(struct net_device *dev)
 		for (i = 0; i < t->count; i++) {
 			s = t->routes[i].neighbour;
 			if (s->dev == dev) {
+				s->count--;
+				nr_neigh_put(s);
+
 				t->count--;
 
 				switch (i) {
-- 
2.43.0