[IPV6] UDP: Possible dst leak in udpv6_sendmsg.

ip6_sk_dst_lookup returns held dst entry. It should be released
on all paths beyond this point. Add missed release when up->pending
is set.

Bug report and initial patch by Denis V. Lunev <[email protected]>.

Signed-off-by: YOSHIFUJI Hideaki <[email protected]>
Acked-by: Denis V. Lunev <[email protected]>

diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 1fd784f3e2ecf4dba2f48dd6ff134172b80df0d5..47123bf5eb0fb439a944cfbcfe99112b97e157d1 100644 (file)
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -848,12 +848,14 @@ do_append_data:
                } else {
                        dst_release(dst);
                }
+               dst = NULL;
        }
 
        if (err > 0)
                err = np->recverr ? net_xmit_errno(err) : 0;
        release_sock(sk);
 out:
+       dst_release(dst);
        fl6_sock_release(flowlabel);
        if (!err)
                return len;