diff options
| author | melifaro <melifaro@FreeBSD.org> | 2016-01-20 11:25:30 +0000 |
|---|---|---|
| committer | melifaro <melifaro@FreeBSD.org> | 2016-01-20 11:25:30 +0000 |
| commit | 962b1b7134b89da43040bcdd0ad7b0f42fe611a5 (patch) | |
| tree | 2010e2bf27f200ff977c46c23c65ccfed80d3829 /sys/netinet6 | |
| parent | 19166ffb0374bc1ad6d538fd356fcfffa8f2676a (diff) | |
| download | FreeBSD-src-962b1b7134b89da43040bcdd0ad7b0f42fe611a5.zip FreeBSD-src-962b1b7134b89da43040bcdd0ad7b0f42fe611a5.tar.gz | |
Fix rte refcount leak in ip6_forward().
Reviewed by: ae
MFC after: 2 weeks
Sponsored by: Yandex LLC
Diffstat (limited to 'sys/netinet6')
| -rw-r--r-- | sys/netinet6/ip6_forward.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/sys/netinet6/ip6_forward.c b/sys/netinet6/ip6_forward.c index 5f794db..e8810d6 100644 --- a/sys/netinet6/ip6_forward.c +++ b/sys/netinet6/ip6_forward.c @@ -341,6 +341,7 @@ again: dst->sin6_addr = ip6->ip6_dst; again2: rin6.ro_rt = in6_rtalloc1((struct sockaddr *)dst, 0, 0, M_GETFIB(m)); + rt = rin6.ro_rt; if (rin6.ro_rt != NULL) RT_UNLOCK(rin6.ro_rt); else { @@ -352,7 +353,6 @@ again2: } goto bad; } - rt = rin6.ro_rt; /* * Source scope check: if a packet can't be delivered to its @@ -505,8 +505,10 @@ again2: /* If destination is now ourself drop to ip6_input(). */ if (in6_localip(&ip6->ip6_dst)) m->m_flags |= M_FASTFWD_OURS; - else + else { + RTFREE(rt); goto again; /* Redo the routing table lookup. */ + } } /* See if local, if yes, send it to netisr. */ @@ -533,6 +535,7 @@ again2: m->m_flags |= M_SKIP_FIREWALL; m->m_flags &= ~M_IP6_NEXTHOP; m_tag_delete(m, fwd_tag); + RTFREE(rt); goto again2; } |
