On 8/30/18 10:11 AM, Alexey Kodanev wrote: > Commit 80f1a0f4e0cd ("net/ipv6: Put lwtstate when destroying fib6_info") > partially fixed the kmemleak [1], lwtstate can be copied from fib6_info, > with ip6_rt_copy_init(), and it should be done only once there. > > rt->dst.lwtstate is set by ip6_rt_init_dst(), at the start of the function > ip6_rt_copy_init(), so there is no need to get it again at the end. > > With this patch, lwtstate also isn't copied from RTF_REJECT routes.
Those should not have lwtstate set. > > [1]: > unreferenced object 0xffff880b6aaa14e0 (size 64): > comm "ip", pid 10577, jiffies 4295149341 (age 1273.903s) > hex dump (first 32 bytes): > 01 00 04 00 04 00 00 00 10 00 00 00 00 00 00 00 ................ > 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ > backtrace: > [<0000000018664623>] lwtunnel_build_state+0x1bc/0x420 > [<00000000b73aa29a>] ip6_route_info_create+0x9f7/0x1fd0 > [<00000000ee2c5d1f>] ip6_route_add+0x14/0x70 > [<000000008537b55c>] inet6_rtm_newroute+0xd9/0xe0 > [<000000002acc50f5>] rtnetlink_rcv_msg+0x66f/0x8e0 > [<000000008d9cd381>] netlink_rcv_skb+0x268/0x3b0 > [<000000004c893c76>] netlink_unicast+0x417/0x5a0 > [<00000000f2ab1afb>] netlink_sendmsg+0x70b/0xc30 > [<00000000890ff0aa>] sock_sendmsg+0xb1/0xf0 > [<00000000a2e7b66f>] ___sys_sendmsg+0x659/0x950 > [<000000001e7426c8>] __sys_sendmsg+0xde/0x170 > [<00000000fe411443>] do_syscall_64+0x9f/0x4a0 > [<000000001be7b28b>] entry_SYSCALL_64_after_hwframe+0x49/0xbe > [<000000006d21f353>] 0xffffffffffffffff What test did you run to uncover this? Curious as to why my testing that found the need for 80f1a0f4e0cd did not hit this. > > Fixes: 6edb3c96a5f0 ("net/ipv6: Defer initialization of dst to data path") > Signed-off-by: Alexey Kodanev <alexey.koda...@oracle.com> > --- > net/ipv6/route.c | 1 - > 1 file changed, 1 deletion(-) > > diff --git a/net/ipv6/route.c b/net/ipv6/route.c > index 8e08a91..9f27ada 100644 > --- a/net/ipv6/route.c > +++ b/net/ipv6/route.c > @@ -996,7 +996,6 @@ static void ip6_rt_copy_init(struct rt6_info *rt, struct > fib6_info *ort) > rt->rt6i_src = ort->fib6_src; > #endif > rt->rt6i_prefsrc = ort->fib6_prefsrc; > - rt->dst.lwtstate = lwtstate_get(ort->fib6_nh.nh_lwtstate); > } > > static struct fib6_node* fib6_backtrack(struct fib6_node *fn, > Thanks for the patch. Reviewed-by: David Ahern <dsah...@gmail.com>