leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

net/ipv6: fix metrics leak

Browse Source 
Since commit d4ead6b34b ("net/ipv6: move metrics from dst to
rt6_info"), ipv6 metrics are shared and refcounted. rt6_set_from()
assigns the rt->from pointer and increases the refcount on from's
metrics. This reference is never released.

Introduce the fib6_metrics_release() helper and use it to release the
metrics.

Fixes: d4ead6b34b ("net/ipv6: move metrics from dst to rt6_info")
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Sabrina Dubroca 2018-07-30 16:23:10 +02:00 committed by David S. Miller
parent 822fb18a82
commit df18b50448
1 changed files with 14 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
net/ipv6/ip6_fib.c
View File

@ -167,11 +167,22 @@ struct fib6_info *fib6_info_alloc(gfp_t gfp_flags)
return f6i; return f6i;
} }
static void fib6_metrics_release(struct fib6_info *f6i)
{
struct dst_metrics *m;
if (!f6i)
return;
m = f6i->fib6_metrics;
if (m != &dst_default_metrics && refcount_dec_and_test(&m->refcnt))
kfree(m);
}
void fib6_info_destroy_rcu(struct rcu_head *head) void fib6_info_destroy_rcu(struct rcu_head *head)
{ {
struct fib6_info *f6i = container_of(head, struct fib6_info, rcu); struct fib6_info *f6i = container_of(head, struct fib6_info, rcu);
struct rt6_exception_bucket *bucket; struct rt6_exception_bucket *bucket;
struct dst_metrics *m;
WARN_ON(f6i->fib6_node); WARN_ON(f6i->fib6_node);
@ -201,9 +212,7 @@ void fib6_info_destroy_rcu(struct rcu_head *head)
if (f6i->fib6_nh.nh_dev) if (f6i->fib6_nh.nh_dev)
dev_put(f6i->fib6_nh.nh_dev); dev_put(f6i->fib6_nh.nh_dev);
m = f6i->fib6_metrics; fib6_metrics_release(f6i);
if (m != &dst_default_metrics && refcount_dec_and_test(&m->refcnt))
kfree(m);
kfree(f6i); kfree(f6i);
} }
@ -887,6 +896,7 @@ static void fib6_drop_pcpu_from(struct fib6_info *f6i,
from = rcu_dereference_protected(pcpu_rt->from, from = rcu_dereference_protected(pcpu_rt->from,
lockdep_is_held(&table->tb6_lock)); lockdep_is_held(&table->tb6_lock));
fib6_metrics_release(from);
rcu_assign_pointer(pcpu_rt->from, NULL); rcu_assign_pointer(pcpu_rt->from, NULL);
fib6_info_release(from); fib6_info_release(from);
} }