From owner-svn-src-stable-10@FreeBSD.ORG Mon Jul 21 20:38:22 2014 Return-Path: Delivered-To: svn-src-stable-10@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 9062A5B0; Mon, 21 Jul 2014 20:38:22 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 6402820EA; Mon, 21 Jul 2014 20:38:22 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.8/8.14.8) with ESMTP id s6LKcM49028732; Mon, 21 Jul 2014 20:38:22 GMT (envelope-from np@svn.freebsd.org) Received: (from np@localhost) by svn.freebsd.org (8.14.8/8.14.8/Submit) id s6LKcM9V028731; Mon, 21 Jul 2014 20:38:22 GMT (envelope-from np@svn.freebsd.org) Message-Id: <201407212038.s6LKcM9V028731@svn.freebsd.org> From: Navdeep Parhar Date: Mon, 21 Jul 2014 20:38:22 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org Subject: svn commit: r268956 - stable/10/sys/netinet X-SVN-Group: stable-10 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-stable-10@freebsd.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: SVN commit messages for only the 10-stable src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 21 Jul 2014 20:38:22 -0000 Author: np Date: Mon Jul 21 20:38:21 2014 New Revision: 268956 URL: http://svnweb.freebsd.org/changeset/base/268956 Log: MFC r268450 (by glebius). The leak affects stable/10 too. In several cases in ip_output() we obtain reference on ifa. Do not leak it. Modified: stable/10/sys/netinet/ip_output.c Directory Properties: stable/10/ (props changed) Modified: stable/10/sys/netinet/ip_output.c ============================================================================== --- stable/10/sys/netinet/ip_output.c Mon Jul 21 20:08:53 2014 (r268955) +++ stable/10/sys/netinet/ip_output.c Mon Jul 21 20:38:21 2014 (r268956) @@ -135,6 +135,7 @@ ip_output(struct mbuf *m, struct mbuf *o struct rtentry *rte; /* cache for ro->ro_rt */ struct in_addr odst; struct m_tag *fwd_tag = NULL; + int have_ia_ref; #ifdef IPSEC int no_route_but_check_spd = 0; #endif @@ -200,6 +201,7 @@ ip_output(struct mbuf *m, struct mbuf *o gw = dst = (struct sockaddr_in *)&ro->ro_dst; again: ia = NULL; + have_ia_ref = 0; /* * If there is a cached route, * check that it is to the same destination @@ -237,6 +239,7 @@ again: error = ENETUNREACH; goto bad; } + have_ia_ref = 1; ip->ip_dst.s_addr = INADDR_BROADCAST; dst->sin_addr = ip->ip_dst; ifp = ia->ia_ifp; @@ -249,6 +252,7 @@ again: error = ENETUNREACH; goto bad; } + have_ia_ref = 1; ifp = ia->ia_ifp; ip->ip_ttl = 1; isbroadcast = in_broadcast(dst->sin_addr, ifp); @@ -260,6 +264,8 @@ again: */ ifp = imo->imo_multicast_ifp; IFP_TO_IA(ifp, ia); + if (ia) + have_ia_ref = 1; isbroadcast = 0; /* fool gcc */ } else { /* @@ -531,8 +537,11 @@ sendit: #endif error = netisr_queue(NETISR_IP, m); goto done; - } else + } else { + if (have_ia_ref) + ifa_free(&ia->ia_ifa); goto again; /* Redo the routing table lookup. */ + } } /* See if local, if yes, send it to netisr with IP_FASTFWD_OURS. */ @@ -561,6 +570,8 @@ sendit: m->m_flags |= M_SKIP_FIREWALL; m->m_flags &= ~M_IP_NEXTHOP; m_tag_delete(m, fwd_tag); + if (have_ia_ref) + ifa_free(&ia->ia_ifa); goto again; } @@ -671,6 +682,8 @@ passout: done: if (ro == &iproute) RO_RTFREE(ro); + if (have_ia_ref) + ifa_free(&ia->ia_ifa); return (error); bad: m_freem(m);