d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Plug nexthop group refcount leak.

Browse Source 
In case with batch route delete via rib_walk_del(), when
 some paths from the multipath route gets deleted, old
 multipath group were not freed.

PR:    254496
Reported by:   Zhenlei Huang <zlei.huang@gmail.com>
MFC after:     1 day
This commit is contained in:
Alexander V. Chernikov 2021-03-24 23:51:45 +00:00
parent e086aff91c
commit 66f138563b
1 changed files with 14 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
sys/net/route/route_ctl.c
View File

@ -130,6 +130,7 @@ vnet_rtzone_destroy()
static void
destroy_rtentry(struct rtentry *rt)
{
#ifdef VIMAGE
struct nhop_object *nh = rt->rt_nhop;
/*
@ -146,9 +147,10 @@ destroy_rtentry(struct rtentry *rt)
}
#endif
CURVNET_SET(nhop_get_vnet(nh));
#endif
/* Unreference nexthop */
nhop_free_any(nh);
nhop_free_any(rt->rt_nhop);
uma_zfree(V_rtzone, rt);
@ -1239,7 +1241,6 @@ rt_checkdelroute(struct radix_node *rn, void *arg)
struct rt_delinfo *di;
struct rt_addrinfo *info;
struct rtentry *rt;
int error;
di = (struct rt_delinfo *)arg;
rt = (struct rtentry *)rn;
@ -1248,7 +1249,8 @@ rt_checkdelroute(struct radix_node *rn, void *arg)
info->rti_info[RTAX_DST] = rt_key(rt);
info->rti_info[RTAX_NETMASK] = rt_mask(rt);
error = rt_unlinkrte(di->rnh, info, &di->rc);
if (rt_unlinkrte(di->rnh, info, &di->rc) != 0)
return (0);
/*
* Add deleted rtentries to the list to GC them
@ -1257,11 +1259,19 @@ rt_checkdelroute(struct radix_node *rn, void *arg)
* XXX: Delayed notifications not implemented
* for nexthop updates.
*/
if ((error == 0) && (di->rc.rc_cmd == RTM_DELETE)) {
if (di->rc.rc_cmd == RTM_DELETE) {
/* Add to the list and return */
rt->rt_chain = di->head;
di->head = rt;
#ifdef ROUTE_MPATH
} else {
/*
* RTM_CHANGE to a diferent nexthop or nexthop group.
* Free old multipath group.
*/
nhop_free_any(di->rc.rc_nh_old);
}
#endif
return (0);
}