svn commit: r268956 - stable/10/sys/netinet
Navdeep Parhar
np at FreeBSD.org
Mon Jul 21 20:38:22 UTC 2014
Author: np
Date: Mon Jul 21 20:38:21 2014
New Revision: 268956
URL: http://svnweb.freebsd.org/changeset/base/268956
Log:
MFC r268450 (by glebius). The leak affects stable/10 too.
In several cases in ip_output() we obtain reference on ifa. Do not
leak it.
Modified:
stable/10/sys/netinet/ip_output.c
Directory Properties:
stable/10/ (props changed)
Modified: stable/10/sys/netinet/ip_output.c
==============================================================================
--- stable/10/sys/netinet/ip_output.c Mon Jul 21 20:08:53 2014 (r268955)
+++ stable/10/sys/netinet/ip_output.c Mon Jul 21 20:38:21 2014 (r268956)
@@ -135,6 +135,7 @@ ip_output(struct mbuf *m, struct mbuf *o
struct rtentry *rte; /* cache for ro->ro_rt */
struct in_addr odst;
struct m_tag *fwd_tag = NULL;
+ int have_ia_ref;
#ifdef IPSEC
int no_route_but_check_spd = 0;
#endif
@@ -200,6 +201,7 @@ ip_output(struct mbuf *m, struct mbuf *o
gw = dst = (struct sockaddr_in *)&ro->ro_dst;
again:
ia = NULL;
+ have_ia_ref = 0;
/*
* If there is a cached route,
* check that it is to the same destination
@@ -237,6 +239,7 @@ again:
error = ENETUNREACH;
goto bad;
}
+ have_ia_ref = 1;
ip->ip_dst.s_addr = INADDR_BROADCAST;
dst->sin_addr = ip->ip_dst;
ifp = ia->ia_ifp;
@@ -249,6 +252,7 @@ again:
error = ENETUNREACH;
goto bad;
}
+ have_ia_ref = 1;
ifp = ia->ia_ifp;
ip->ip_ttl = 1;
isbroadcast = in_broadcast(dst->sin_addr, ifp);
@@ -260,6 +264,8 @@ again:
*/
ifp = imo->imo_multicast_ifp;
IFP_TO_IA(ifp, ia);
+ if (ia)
+ have_ia_ref = 1;
isbroadcast = 0; /* fool gcc */
} else {
/*
@@ -531,8 +537,11 @@ sendit:
#endif
error = netisr_queue(NETISR_IP, m);
goto done;
- } else
+ } else {
+ if (have_ia_ref)
+ ifa_free(&ia->ia_ifa);
goto again; /* Redo the routing table lookup. */
+ }
}
/* See if local, if yes, send it to netisr with IP_FASTFWD_OURS. */
@@ -561,6 +570,8 @@ sendit:
m->m_flags |= M_SKIP_FIREWALL;
m->m_flags &= ~M_IP_NEXTHOP;
m_tag_delete(m, fwd_tag);
+ if (have_ia_ref)
+ ifa_free(&ia->ia_ifa);
goto again;
}
@@ -671,6 +682,8 @@ passout:
done:
if (ro == &iproute)
RO_RTFREE(ro);
+ if (have_ia_ref)
+ ifa_free(&ia->ia_ifa);
return (error);
bad:
m_freem(m);
More information about the svn-src-stable
mailing list