diff options
| author | Zhiling Zou <zhilinz@nebusec.ai> | 2026-07-24 00:48:52 +0800 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-07-27 15:20:01 -0700 |
| commit | 6aea62e433fe1b586202a5fee8b5807ce635e1d7 (patch) | |
| tree | 38e2307f5318774f89ac7c8c6f3d91ef55f0f864 | |
| parent | b4f1719dfea023220e0e6bd892b087d76b2a6a49 (diff) | |
| download | linux-next-6aea62e433fe1b586202a5fee8b5807ce635e1d7.tar.gz linux-next-6aea62e433fe1b586202a5fee8b5807ce635e1d7.zip | |
net: ipv6: clear suppressed fib6 rule result
fib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(),
but leaves res->rt6 pointing at the released rt6_info.
If no later rule supplies a replacement, fib6_rule_lookup() still sees
res.rt6 and returns that stale dst to its caller. A suppressing rule can
therefore leak a released route back to rt6_lookup(), and the next put
hits rcuref_put_slowpath() from dst_release().
Clear res->rt6 when suppressing the route so suppressed lookups fall
through to the null dst instead of reusing the released one.
Fixes: cdef485217d3 ("ipv6: fix memory leak in fib6_rule_suppress")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
Signed-off-by: Ren Wei <enjou1224z@gmail.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/4b8acb7787d54e440155585dd32ebdf0bef7d122.1784710966.git.zhilinz@nebusec.ai
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
| -rw-r--r-- | net/ipv6/fib6_rules.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c index e1b2b4fa6e18..89ee3c969ca7 100644 --- a/net/ipv6/fib6_rules.c +++ b/net/ipv6/fib6_rules.c @@ -308,6 +308,7 @@ INDIRECT_CALLABLE_SCOPE bool fib6_rule_suppress(struct fib_rule *rule, suppress_route: ip6_rt_put_flags(rt, flags); + res->rt6 = NULL; return true; } |