diff options
| author | Denys Fedoryshchenko <denys.f@collabora.com> | 2026-07-07 01:12:45 +0300 |
|---|---|---|
| committer | Denys Fedoryshchenko <denys.f@collabora.com> | 2026-07-07 01:15:06 +0300 |
| commit | 7a7ab323158a63f222698f85179090e3b6030b96 (patch) | |
| tree | c307391edfe62528035fe8cb0b8f07c86a0664ab /accel-pppd/ctrl | |
| parent | f4014a4a2c9e654646faeb81cd9ac5841b1c9b0f (diff) | |
| download | accel-ppp-7a7ab323158a63f222698f85179090e3b6030b96.tar.gz accel-ppp-7a7ab323158a63f222698f85179090e3b6030b96.zip | |
ipoe: fix dhcpv4 relay reply packet leak
dhcpv4_relay_read() takes a reference on the reply packet for every
registered listener context and hands it over via triton_context_call().
The receiving ipoe_ses_recv_dhcpv4_relay() consumes that reference by
storing the packet in ses->dhcpv4_relay_reply, but the early-return
branch taken when the original request is already gone dropped the
reference without freeing the packet.
This leaks one packet every time a relay reply races with the request
being released, which happens regularly on busy relay-mode deployments.
Reported-by: Louis Scalbert (#101)
Diffstat (limited to 'accel-pppd/ctrl')
| -rw-r--r-- | accel-pppd/ctrl/ipoe/ipoe.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/accel-pppd/ctrl/ipoe/ipoe.c b/accel-pppd/ctrl/ipoe/ipoe.c index 4bf43434..d7df2f38 100644 --- a/accel-pppd/ctrl/ipoe/ipoe.c +++ b/accel-pppd/ctrl/ipoe/ipoe.c @@ -2030,6 +2030,7 @@ static void ipoe_ses_recv_dhcpv4_relay(struct dhcpv4_packet *pack) if (!ses->dhcpv4_request) { ses->dhcpv4_relay_reply = NULL; + dhcpv4_packet_free(pack); return; } |