From: David Miller <[EMAIL PROTECTED]>
Date: Wed, 06 Dec 2006 23:37:49 -0800 (PST)
> From: Kazunori MIYAZAWA <[EMAIL PROTECTED]>
> Date: Wed, 6 Dec 2006 20:35:37 +0900
>
> > BTW, I have a question about descrementing the reference count of
> > rt->peer. The reference cound in normal "dst" structure is
> > decremented by calling inet_putpeer from ipv4_dst_destroy. But
> > xfrm4_dst_destroy does not call inet_putpeer. Where do we decrement
> > the count? Should xfrm4_dst_destroy do that?
>
> Indeed, it is a real leak. And yes, I believe that xfrm4_dst_destroy()
> should release it. I will make this fix, thank you.
For reference, this is the fix I checked in.
Thanks again for spotting this problem.
I suppose your patch will need to add an address family check for this
too. Actually... I think address family check is needed for 'idev'
release in xfrm4_dst_destroy() too, if you agree please also add that
fix to your patch.
It is very complicated, using IPV6 route in xfrm4 code, because now
all "X->u.rt" references need to be audited.
commit 26db167702756d0022f8ea5f1f30cad3018cfe31
Author: David S. Miller <[EMAIL PROTECTED]>
Date: Wed Dec 6 23:45:15 2006 -0800
[IPSEC]: Fix inetpeer leak in ipv4 xfrm dst entries.
We grab a reference to the route's inetpeer entry but
forget to release it in xfrm4_dst_destroy().
Bug discovered by Kazunori MIYAZAWA <[EMAIL PROTECTED]>
Signed-off-by: David S. Miller <[EMAIL PROTECTED]>
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index d4107bb..fb9f69c 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -274,6 +274,8 @@ static void xfrm4_dst_destroy(struct dst
if (likely(xdst->u.rt.idev))
in_dev_put(xdst->u.rt.idev);
+ if (likely(xdst->u.rt.peer))
+ inet_putpeer(xdst->u.rt.peer);
xfrm_dst_destroy(xdst);
}
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
