Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ce7ea4af authored by Wei Wang's avatar Wei Wang Committed by David S. Miller
Browse files

ipv6: fix memory leak on dst->_metrics 



When dst->_metrics and f6i->fib6_metrics share the same memory, both
take reference count on the dst_metrics structure. However, when dst is
destroyed, ip6_dst_destroy() only invokes dst_destroy_metrics_generic()
which does not take care of READONLY metrics and does not release refcnt.
This causes memory leak.
Similar to ipv4 logic, the fix is to properly release refcnt and free
the memory space pointed by dst->_metrics if refcnt becomes 0.

Fixes: 93531c67 ("net/ipv6: separate handling of FIB entries from dst based routes")
Reported-by: default avatarSabrina Dubroca <sd@queasysnail.net>
Signed-off-by: default avatarWei Wang <weiwan@google.com>
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Reviewed-by: default avatarDavid Ahern <dsahern@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 86758605

net/ipv6/route.c

+4 −1
Original line number Original line Diff line number Diff line
@@ -364,11 +364,14 @@ EXPORT_SYMBOL(ip6_dst_alloc); 




static void ip6_dst_destroy(struct dst_entry *dst)

static void ip6_dst_destroy(struct dst_entry *dst)

{

{

	struct dst_metrics *p = (struct dst_metrics *)DST_METRICS_PTR(dst);

	struct rt6_info *rt = (struct rt6_info *)dst;

	struct rt6_info *rt = (struct rt6_info *)dst;

	struct fib6_info *from;

	struct fib6_info *from;

	struct inet6_dev *idev;

	struct inet6_dev *idev;





	dst_destroy_metrics_generic(dst);

	if (p != &dst_default_metrics && refcount_dec_and_test(&p->refcnt))

		kfree(p);



	rt6_uncached_list_del(rt);

	rt6_uncached_list_del(rt);





	idev = rt->rt6i_idev;

	idev = rt->rt6i_idev;