Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ba1cc08d authored by Sabrina Dubroca's avatar Sabrina Dubroca Committed by David S. Miller
Browse files

ipv6: fix memory leak with multiple tables during netns destruction 



fib6_net_exit only frees the main and local tables. If another table was
created with fib6_alloc_table, we leak it when the netns is destroyed.

Fix this in the same way ip_fib_net_exit cleans up tables, by walking
through the whole hashtable of fib6_table's. We can get rid of the
special cases for local and main, since they're also part of the
hashtable.

Reproducer:
    ip netns add x
    ip -net x -6 rule add from 6003:1::/64 table 100
    ip netns del x

Reported-by: default avatarJianlin Shi <jishi@redhat.com>
Fixes: 58f09b78 ("[NETNS][IPV6] ip6_fib - make it per network namespace")
Signed-off-by: default avatarSabrina Dubroca <sd@queasysnail.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 126f760c

net/ipv6/ip6_fib.c

+19 −6
Original line number Original line Diff line number Diff line
@@ -191,6 +191,12 @@ void rt6_free_pcpu(struct rt6_info *non_pcpu_rt) 
}

}

EXPORT_SYMBOL_GPL(rt6_free_pcpu);

EXPORT_SYMBOL_GPL(rt6_free_pcpu);





static void fib6_free_table(struct fib6_table *table)

{

	inetpeer_invalidate_tree(&table->tb6_peers);

	kfree(table);

}



static void fib6_link_table(struct net *net, struct fib6_table *tb)

static void fib6_link_table(struct net *net, struct fib6_table *tb)

{

{

	unsigned int h;

	unsigned int h;
@@ -2022,15 +2028,22 @@ static int __net_init fib6_net_init(struct net *net) 




static void fib6_net_exit(struct net *net)

static void fib6_net_exit(struct net *net)

{

{

	unsigned int i;



	rt6_ifdown(net, NULL);

	rt6_ifdown(net, NULL);

	del_timer_sync(&net->ipv6.ip6_fib_timer);

	del_timer_sync(&net->ipv6.ip6_fib_timer);





#ifdef CONFIG_IPV6_MULTIPLE_TABLES

	for (i = 0; i < FIB_TABLE_HASHSZ; i++) {

	inetpeer_invalidate_tree(&net->ipv6.fib6_local_tbl->tb6_peers);

		struct hlist_head *head = &net->ipv6.fib_table_hash[i];

	kfree(net->ipv6.fib6_local_tbl);

		struct hlist_node *tmp;

#endif

		struct fib6_table *tb;

	inetpeer_invalidate_tree(&net->ipv6.fib6_main_tbl->tb6_peers);



	kfree(net->ipv6.fib6_main_tbl);

		hlist_for_each_entry_safe(tb, tmp, head, tb6_hlist) {

			hlist_del(&tb->tb6_hlist);

			fib6_free_table(tb);

		}

	}



	kfree(net->ipv6.fib_table_hash);

	kfree(net->ipv6.fib_table_hash);

	kfree(net->ipv6.rt6_stats);

	kfree(net->ipv6.rt6_stats);

	fib6_notifier_exit(net);

	fib6_notifier_exit(net);