ipv6: ip6_make_skb() needs to clear cork.base.dst
Subsystems (3)
PATCH 1/1 ipv6: ip6_make_skb() needs to clear cork.base.dst
From: Eric Dumazet <[email protected]>
In my last patch, I missed fact that cork.base.dst was not initialized in ip6_make_skb() :
If ip6_setup_cork() returns an error, we might attempt a dst_release() on some random pointer.
Fixes 862c03ee1deb ("ipv6: fix possible mem leaks in ipv6_make_skb()")
Signed-off-by Eric Dumazet <[email protected]>
Reported-by syzbot <[email protected]>
---
net/ipv6/ip6_output.c | 1 +
1 file changed, 1 insertion(+)
net/ipv6/ip6_output.c +1 -0
@@ -1733,6 +1733,7 @@ struct sk_buff *ip6_make_skb(struct sock *sk, cork.base.flags =0 ; cork.base.addr =0 ; cork.base.opt =NULL ; + cork.base.dst =NULL ; v6_cork.opt =NULL ; err =ip6_setup_cork (sk, &cork, &v6_cork, ipc6, rt, fl6);if (err) {
David Miller
maintainerFrom: Eric Dumazet <[email protected]>
Date: Thu, 11 Jan 2018 22:31:18 -0800
Quoted 11 lines
From: Eric Dumazet <[email protected]>
In my last patch, I missed fact that cork.base.dst was not initialized in
ip6_make_skb():If
ip6_setup_cork()returns an error, we might attempt adst_release()on some random pointer.Fixes 862c03ee1deb ("ipv6: fix possible mem leaks in ipv6_make_skb()")Signed-off-by Eric Dumazet <[email protected]>Reported-by syzbot <[email protected]>
Applied and queued up for -stable, thanks Eric.