Messages in this thread |  | | Subject | Re: [PATCH] ipv6: Fix nexthop refcnt leak when creating ipv6 route info | From | David Ahern <> | Date | Sat, 25 Jul 2020 18:07:49 -0600 |
| |
On 7/25/20 2:02 AM, Xiyu Yang wrote: > ip6_route_info_create() invokes nexthop_get(), which increases the > refcount of the "nh". > > When ip6_route_info_create() returns, local variable "nh" becomes > invalid, so the refcount should be decreased to keep refcount balanced.
I forgot to write the test case for this very code path in tools/testing/selftests/net/fib_nexthops.sh. If you have the time, it goes in ipv6_fcnal_runtime() - see the last 'TO-DO' item.
> > The reference counting issue happens in one exception handling path of > ip6_route_info_create(). When nexthops can not be used with source > routing, the function forgets to decrease the refcnt increased by > nexthop_get(), causing a refcnt leak. > > Fix this issue by pulling up the error source routing handling when > nexthops can not be used with source routing. >
Fixes: f88d8ea67fbd ("ipv6: Plumb support for nexthop object in a fib6_info")
> Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn> > Signed-off-by: Xin Tan <tanxin.ctf@gmail.com> > --- > net/ipv6/route.c | 8 ++++---- > 1 file changed, 4 insertions(+), 4 deletions(-) >
Reviewed-by: David Ahern <dsahern@kernel.org>
|  |