Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 07f61557 authored by Serhey Popovych's avatar Serhey Popovych Committed by David S. Miller
Browse files

ipv6: Do not leak throw route references 



While commit 73ba57bf ("ipv6: fix backtracking for throw routes")
does good job on error propagation to the fib_rules_lookup()
in fib rules core framework that also corrects throw routes
handling, it does not solve route reference leakage problem
happened when we return -EAGAIN to the fib_rules_lookup()
and leave routing table entry referenced in arg->result.

If rule with matched throw route isn't last matched in the
list we overwrite arg->result losing reference on throw
route stored previously forever.

We also partially revert commit ab997ad4 ("ipv6: fix the
incorrect return value of throw route") since we never return
routing table entry with dst.error == -EAGAIN when
CONFIG_IPV6_MULTIPLE_TABLES is on. Also there is no point
to check for RTF_REJECT flag since it is always set throw
route.

Fixes: 73ba57bf ("ipv6: fix backtracking for throw routes")
Signed-off-by: default avatarSerhey Popovych <serhe.popovych@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 7e113321

net/ipv6/fib6_rules.c

+6 −16
Original line number Diff line number Diff line
@@ -32,7 +32,6 @@ struct fib6_rule { 
struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi6 *fl6,

				   int flags, pol_lookup_t lookup)

{

	struct rt6_info *rt;

	struct fib_lookup_arg arg = {

		.lookup_ptr = lookup,

		.flags = FIB_LOOKUP_NOREF,
@@ -44,23 +43,13 @@ struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi6 *fl6, 
	fib_rules_lookup(net->ipv6.fib6_rules_ops,

			 flowi6_to_flowi(fl6), flags, &arg);



	rt = arg.result;

	if (arg.result)

		return arg.result;



	if (!rt) {

	dst_hold(&net->ipv6.ip6_null_entry->dst);

	return &net->ipv6.ip6_null_entry->dst;

}



	if (rt->rt6i_flags & RTF_REJECT &&

	    rt->dst.error == -EAGAIN) {

		ip6_rt_put(rt);

		rt = net->ipv6.ip6_null_entry;

		dst_hold(&rt->dst);

	}



	return &rt->dst;

}



static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,

			    int flags, struct fib_lookup_arg *arg)

{
@@ -121,6 +110,7 @@ static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp, 
			flp6->saddr = saddr;

		}

		err = rt->dst.error;

		if (err != -EAGAIN)

			goto out;

	}

again:

net/ipv6/ip6_fib.c

+1 −2
Original line number Diff line number Diff line
@@ -289,8 +289,7 @@ struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi6 *fl6, 
	struct rt6_info *rt;



	rt = lookup(net, net->ipv6.fib6_main_tbl, fl6, flags);

	if (rt->rt6i_flags & RTF_REJECT &&

	    rt->dst.error == -EAGAIN) {

	if (rt->dst.error == -EAGAIN) {

		ip6_rt_put(rt);

		rt = net->ipv6.ip6_null_entry;

		dst_hold(&rt->dst);