Commit 761f6026 authored Nov 14, 2018 by Xin Long Committed by David S. Miller Nov 16, 2018

ipv6: fix a dst leak when removing its exception



These is no need to hold dst before calling rt6_remove_exception_rt().
The call to dst_hold_safe() in ip6_link_failure() was for ip6_del_rt(),
which has been removed in Commit 93531c67 ("net/ipv6: separate
handling of FIB entries from dst based routes"). Otherwise, it will
cause a dst leak.

This patch is to simply remove the dst_hold_safe() call before calling
rt6_remove_exception_rt() and also do the same in ip6_del_cached_rt().
It's safe, because the removal of the exception that holds its dst's
refcnt is protected by rt6_exception_lock.

Fixes: 93531c67 ("net/ipv6: separate handling of FIB entries from dst based routes")
Fixes: 23fb93a4 ("net/ipv6: Cleanup exception and cache route handling")
Reported-by: Li Shuang <shuali@redhat.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Reviewed-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 83e65df6

net/ipv6/route.c

+3 −4

Original line number	Diff line number	Diff line
		@@ -2232,7 +2232,6 @@ static void ip6_link_failure(struct sk_buff *skb)
		if (rt) {
		rcu_read_lock();
		if (rt->rt6i_flags & RTF_CACHE) {
		if (dst_hold_safe(&rt->dst))
		rt6_remove_exception_rt(rt);
		} else {
		struct fib6_info *from;
		@@ -3214,7 +3213,7 @@ static int ip6_del_cached_rt(struct rt6_info rt, struct fib6_config cfg)
		if (cfg->fc_flags & RTF_GATEWAY &&
		!ipv6_addr_equal(&cfg->fc_gateway, &rt->rt6i_gateway))
		goto out;
		if (dst_hold_safe(&rt->dst))

		rc = rt6_remove_exception_rt(rt);
		out:
		return rc;

Admin message