From c214139aeb23d7521a82818500581c4a51f9e403 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 11 Mar 2025 15:55:02 +0100 Subject: [PATCH] 5.10-stable patches added patches: net-ipv6-fix-dst-refleaks-in-rpl-seg6-and-ioam6-lwtunnels.patch --- ...eaks-in-rpl-seg6-and-ioam6-lwtunnels.patch | 75 +++++++++++++++++++ queue-5.10/series | 1 + 2 files changed, 76 insertions(+) create mode 100644 queue-5.10/net-ipv6-fix-dst-refleaks-in-rpl-seg6-and-ioam6-lwtunnels.patch diff --git a/queue-5.10/net-ipv6-fix-dst-refleaks-in-rpl-seg6-and-ioam6-lwtunnels.patch b/queue-5.10/net-ipv6-fix-dst-refleaks-in-rpl-seg6-and-ioam6-lwtunnels.patch new file mode 100644 index 0000000000..228fb94f31 --- /dev/null +++ b/queue-5.10/net-ipv6-fix-dst-refleaks-in-rpl-seg6-and-ioam6-lwtunnels.patch @@ -0,0 +1,75 @@ +From c71a192976ded2f2f416d03c4f595cdd4478b825 Mon Sep 17 00:00:00 2001 +From: Jakub Kicinski +Date: Wed, 29 Jan 2025 19:15:18 -0800 +Subject: net: ipv6: fix dst refleaks in rpl, seg6 and ioam6 lwtunnels + +From: Jakub Kicinski + +commit c71a192976ded2f2f416d03c4f595cdd4478b825 upstream. + +dst_cache_get() gives us a reference, we need to release it. + +Discovered by the ioam6.sh test, kmemleak was recently fixed +to catch per-cpu memory leaks. + +Fixes: 985ec6f5e623 ("net: ipv6: rpl_iptunnel: mitigate 2-realloc issue") +Fixes: 40475b63761a ("net: ipv6: seg6_iptunnel: mitigate 2-realloc issue") +Fixes: dce525185bc9 ("net: ipv6: ioam6_iptunnel: mitigate 2-realloc issue") +Reviewed-by: Justin Iurman +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20250130031519.2716843-1-kuba@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/rpl_iptunnel.c | 6 ++++-- + net/ipv6/seg6_iptunnel.c | 2 +- + 2 files changed, 5 insertions(+), 3 deletions(-) + +--- a/net/ipv6/rpl_iptunnel.c ++++ b/net/ipv6/rpl_iptunnel.c +@@ -232,7 +232,6 @@ static int rpl_output(struct net *net, s + dst = ip6_route_output(net, NULL, &fl6); + if (dst->error) { + err = dst->error; +- dst_release(dst); + goto drop; + } + +@@ -251,6 +250,7 @@ static int rpl_output(struct net *net, s + return dst_output(net, sk, skb); + + drop: ++ dst_release(dst); + kfree_skb(skb); + return err; + } +@@ -277,8 +277,10 @@ static int rpl_input(struct sk_buff *skb + local_bh_enable(); + + err = rpl_do_srh(skb, rlwt, dst); +- if (unlikely(err)) ++ if (unlikely(err)) { ++ dst_release(dst); + goto drop; ++ } + + skb_dst_drop(skb); + +--- a/net/ipv6/seg6_iptunnel.c ++++ b/net/ipv6/seg6_iptunnel.c +@@ -380,7 +380,6 @@ static int seg6_output(struct net *net, + dst = ip6_route_output(net, NULL, &fl6); + if (dst->error) { + err = dst->error; +- dst_release(dst); + goto drop; + } + +@@ -398,6 +397,7 @@ static int seg6_output(struct net *net, + + return dst_output(net, sk, skb); + drop: ++ dst_release(dst); + kfree_skb(skb); + return err; + } diff --git a/queue-5.10/series b/queue-5.10/series index 1d20c47333..0574a0c12d 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -459,3 +459,4 @@ btrfs-bring-back-the-incorrectly-removed-extent-buffer-lock-recursion-support.pa usb-xhci-enable-the-trb-overfetch-quirk-on-via-vl805.patch perf-cs-etm-add-missing-variable-in-cs_etm__process_queues.patch udf-fix-use-of-check_add_overflow-with-mixed-type-arguments.patch +net-ipv6-fix-dst-refleaks-in-rpl-seg6-and-ioam6-lwtunnels.patch -- 2.47.3