diff options
author | np <np@FreeBSD.org> | 2014-07-21 20:38:21 +0000 |
---|---|---|
committer | np <np@FreeBSD.org> | 2014-07-21 20:38:21 +0000 |
commit | 334efdc74b02c4d0c616f934b9a1a864a9d9b988 (patch) | |
tree | f687618f6c5ece71861cd34d354da26995fa6c0e /sys/netinet | |
parent | 8f6eb3fcf84d124e0864d1e918865ec9fd8b6f82 (diff) | |
download | FreeBSD-src-334efdc74b02c4d0c616f934b9a1a864a9d9b988.zip FreeBSD-src-334efdc74b02c4d0c616f934b9a1a864a9d9b988.tar.gz |
MFC r268450 (by glebius). The leak affects stable/10 too.
In several cases in ip_output() we obtain reference on ifa. Do not
leak it.
Diffstat (limited to 'sys/netinet')
-rw-r--r-- | sys/netinet/ip_output.c | 15 |
1 files changed, 14 insertions, 1 deletions
diff --git a/sys/netinet/ip_output.c b/sys/netinet/ip_output.c index c0a6ffd..aacfeac 100644 --- a/sys/netinet/ip_output.c +++ b/sys/netinet/ip_output.c @@ -135,6 +135,7 @@ ip_output(struct mbuf *m, struct mbuf *opt, struct route *ro, int flags, struct rtentry *rte; /* cache for ro->ro_rt */ struct in_addr odst; struct m_tag *fwd_tag = NULL; + int have_ia_ref; #ifdef IPSEC int no_route_but_check_spd = 0; #endif @@ -200,6 +201,7 @@ ip_output(struct mbuf *m, struct mbuf *opt, struct route *ro, int flags, gw = dst = (struct sockaddr_in *)&ro->ro_dst; again: ia = NULL; + have_ia_ref = 0; /* * If there is a cached route, * check that it is to the same destination @@ -237,6 +239,7 @@ again: error = ENETUNREACH; goto bad; } + have_ia_ref = 1; ip->ip_dst.s_addr = INADDR_BROADCAST; dst->sin_addr = ip->ip_dst; ifp = ia->ia_ifp; @@ -249,6 +252,7 @@ again: error = ENETUNREACH; goto bad; } + have_ia_ref = 1; ifp = ia->ia_ifp; ip->ip_ttl = 1; isbroadcast = in_broadcast(dst->sin_addr, ifp); @@ -260,6 +264,8 @@ again: */ ifp = imo->imo_multicast_ifp; IFP_TO_IA(ifp, ia); + if (ia) + have_ia_ref = 1; isbroadcast = 0; /* fool gcc */ } else { /* @@ -531,8 +537,11 @@ sendit: #endif error = netisr_queue(NETISR_IP, m); goto done; - } else + } else { + if (have_ia_ref) + ifa_free(&ia->ia_ifa); goto again; /* Redo the routing table lookup. */ + } } /* See if local, if yes, send it to netisr with IP_FASTFWD_OURS. */ @@ -561,6 +570,8 @@ sendit: m->m_flags |= M_SKIP_FIREWALL; m->m_flags &= ~M_IP_NEXTHOP; m_tag_delete(m, fwd_tag); + if (have_ia_ref) + ifa_free(&ia->ia_ifa); goto again; } @@ -671,6 +682,8 @@ passout: done: if (ro == &iproute) RO_RTFREE(ro); + if (have_ia_ref) + ifa_free(&ia->ia_ifa); return (error); bad: m_freem(m); |