[PATCH] ipv6 addrconf: Fix memory leak when deleting addresses

[PATCH] ipv6 addrconf: Fix memory leak when deleting addresses

[Thomas Graf]

ip6_del_rt() may fail in which case the dst/route is not released.

Signed-off-by: Thomas graf <tgraf@suug.ch>

Index: net-2.6/net/ipv6/addrconf.c
===================================================================
--- net-2.6.orig/net/ipv6/addrconf.c	2008-06-04 22:59:11.000000000 +0200
+++ net-2.6/net/ipv6/addrconf.c	2008-06-04 23:07:05.000000000 +0200
@@ -779,8 +779,8 @@
 
 		if (rt && ((rt->rt6i_flags & (RTF_GATEWAY | RTF_DEFAULT)) == 0)) {
 			if (onlink == 0) {
-				ip6_del_rt(rt);
-				rt = NULL;
+				if (ip6_del_rt(rt) == 0)
+					goto out;
 			} else if (!(rt->rt6i_flags & RTF_EXPIRES)) {
 				rt->rt6i_expires = expires;
 				rt->rt6i_flags |= RTF_EXPIRES;
@@ -788,7 +788,7 @@
 		}
 		dst_release(&rt->u.dst);
 	}
-
+out:
 	in6_ifa_put(ifp);
 }
 

Re: [PATCH] ipv6 addrconf: Fix memory leak when deleting addresses

[YOSHIFUJI Hideaki / 吉藤英明]

In article <20080604234934.GI20815@postel.suug.ch> (at Thu, 5 Jun 2008 01:49:34 +0200), Thomas Graf <tgraf@suug.ch> says:

> ip6_del_rt() may fail in which case the dst/route is not released.

If prefix is ::/64 and ...

The only case ip6_del_rt() does not call dst_release() is when rt is
ip6_null_entry.  In that case we should skip whole the logic in the
caller, anyway.

Note: it might be better to release refcnt when ip6_del_rt() returns.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>

-- 
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 3a83557..d8ce0d7 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -772,7 +772,7 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp)
 		ipv6_addr_prefix(&prefix, &ifp->addr, ifp->prefix_len);
 		rt = rt6_lookup(net, &prefix, NULL, ifp->idev->dev->ifindex, 1);
 
-		if (rt && ((rt->rt6i_flags & (RTF_GATEWAY | RTF_DEFAULT)) == 0)) {
+		if (rt && ((rt->rt6i_flags & (RTF_REJECT | RTF_GATEWAY | RTF_DEFAULT)) == 0)) {
 			if (onlink == 0) {
 				ip6_del_rt(rt);
 				rt = NULL;
@@ -1789,7 +1789,7 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len)
 		rt = rt6_lookup(dev_net(dev), &pinfo->prefix, NULL,
 				dev->ifindex, 1);
 
-		if (rt && ((rt->rt6i_flags & (RTF_GATEWAY | RTF_DEFAULT)) == 0)) {
+		if (rt && ((rt->rt6i_flags & (RTF_REJECT | RTF_GATEWAY | RTF_DEFAULT)) == 0)) {
 			/* Autoconf prefix route */
 			if (valid_lft == 0) {
 				ip6_del_rt(rt);

-- 
YOSHIFUJI Hideaki @ USAGI Project  <yoshfuji@linux-ipv6.org>
GPG-FP  : 9022 65EB 1ECF 3AD1 0BDF  80D8 4807 F894 E062 0EEA

Re: [PATCH] ipv6 addrconf: Fix memory leak when deleting addresses

[YOSHIFUJI Hideaki / 吉藤英明]

In article <20080605.112646.51075203.yoshfuji@linux-ipv6.org> (at Thu, 05 Jun 2008 11:26:46 +0900 (JST)), YOSHIFUJI Hideaki / 吉藤英明 <yoshfuji@linux-ipv6.org> says:

> In article <20080604234934.GI20815@postel.suug.ch> (at Thu, 5 Jun 2008 01:49:34 +0200), Thomas Graf <tgraf@suug.ch> says:
> 
> > ip6_del_rt() may fail in which case the dst/route is not released.
> 
> If prefix is ::/64 and ...
> 
> The only case ip6_del_rt() does not call dst_release() is when rt is
> ip6_null_entry.  In that case we should skip whole the logic in the
> caller, anyway.

Well, actually, I've found that this cannot even happen
because rt6_lookup() return NULL whenever it hits
ipv6_null_entry.

So, I'm going to drop this.

--yoshfuji