netdev - Re: ipv6: release dst in ping_v6

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20160906185009.6cpnwrytcsogz6r5@codemonkey.org.uk>
Date:   Tue, 6 Sep 2016 14:50:09 -0400
From:   Dave Jones <davej@...emonkey.org.uk>
To:     Eric Dumazet <eric.dumazet@...il.com>
Cc:     Martin KaFai Lau <kafai@...com>, netdev@...r.kernel.org
Subject: Re: ipv6: release dst in ping_v6_sendmsg

On Tue, Sep 06, 2016 at 10:52:43AM -0700, Eric Dumazet wrote:
 
 > > > @@ -126,8 +126,10 @@ static int ping_v6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
 > > >  	rt = (struct rt6_info *) dst;
 > > >
 > > >  	np = inet6_sk(sk);
 > > > -	if (!np)
 > > > -		return -EBADF;
 > > > +	if (!np) {
 > > > +		err = -EBADF;
 > > > +		goto dst_err_out;
 > > > +	}
 > > >
 > > >  	if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
 > > >  		fl6.flowi6_oif = np->mcast_oif;
 > > > @@ -163,6 +165,9 @@ static int ping_v6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
 > > >  	}
 > > >  	release_sock(sk);
 > > >
 > > > +dst_err_out:
 > > > +	dst_release(dst);
 > > > +
 > > >  	if (err)
 > > >  		return err;
 > > >
 > > 
 > > Acked-by: Martin KaFai Lau <kafai@...com>
 > 
 > This really does not make sense to me.
 > 
 > If np was NULL, we should have a crash before.

In the case where I was seeing the traces, we were taking the 'success'
path through the function, so sk was non-null.

 > So we should remove this test, since it is absolutely useless.

Looking closer, it seems the assignment of np is duplicated also,
so that can also go.   This is orthogonal to the dst leak though.
I'll submit a follow-up cleaning that up.

	Dave