Author: melifaro
Date: Wed Jan 20 11:25:30 2016
New Revision: 294411
URL: https://svnweb.freebsd.org/changeset/base/294411
Log:
Fix rte refcount leak in ip6_forward().
Reviewed by: ae
MFC after: 2 weeks
Sponsored by: Yandex LLC
Modified:
head/sys/netinet6/ip6_forward.c
Modified: head/sys/netinet6/ip6_forward.c
==============================================================================
--- head/sys/netinet6/ip6_forward.c Wed Jan 20 11:15:54 2016
(r294410)
+++ head/sys/netinet6/ip6_forward.c Wed Jan 20 11:25:30 2016
(r294411)
@@ -341,6 +341,7 @@ again:
dst->sin6_addr = ip6->ip6_dst;
again2:
rin6.ro_rt = in6_rtalloc1((struct sockaddr *)dst, 0, 0, M_GETFIB(m));
+ rt = rin6.ro_rt;
if (rin6.ro_rt != NULL)
RT_UNLOCK(rin6.ro_rt);
else {
@@ -352,7 +353,6 @@ again2:
}
goto bad;
}
- rt = rin6.ro_rt;
/*
* Source scope check: if a packet can't be delivered to its
@@ -505,8 +505,10 @@ again2:
/* If destination is now ourself drop to ip6_input(). */
if (in6_localip(&ip6->ip6_dst))
m->m_flags |= M_FASTFWD_OURS;
- else
+ else {
+ RTFREE(rt);
goto again; /* Redo the routing table lookup. */
+ }
}
/* See if local, if yes, send it to netisr. */
@@ -533,6 +535,7 @@ again2:
m->m_flags |= M_SKIP_FIREWALL;
m->m_flags &= ~M_IP6_NEXTHOP;
m_tag_delete(m, fwd_tag);
+ RTFREE(rt);
goto again2;
}
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
