netdev - Re: [PATCH RFC v2 net-next 19/21] net/ipv6: separate handling of FIB entries from dst based routes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180324160209.GB15120@splinter>
Date:   Sat, 24 Mar 2018 19:02:09 +0300
From:   Ido Schimmel <idosch@...sch.org>
To:     David Ahern <dsahern@...il.com>
Cc:     netdev@...r.kernel.org, davem@...emloft.net,
        roopa@...ulusnetworks.com, eric.dumazet@...il.com,
        weiwan@...gle.com, kafai@...com, yoshfuji@...ux-ipv6.org
Subject: Re: [PATCH RFC v2 net-next 19/21] net/ipv6: separate handling of FIB
 entries from dst based routes

On Sat, Mar 24, 2018 at 09:31:02AM -0600, David Ahern wrote:
> On 3/24/18 8:31 AM, Ido Schimmel wrote:
> > On Sun, Mar 18, 2018 at 08:36:20PM -0700, David Ahern wrote:
> >> @@ -405,18 +383,9 @@ static void ip6_dst_destroy(struct dst_entry *dst)
> >>  		rt->rt6i_idev = NULL;
> >>  		in6_dev_put(idev);
> >>  	}
> >> -	bucket = rcu_dereference_protected(rt->rt6i_exception_bucket, 1);
> >> -	if (bucket) {
> >> -		rt->rt6i_exception_bucket = NULL;
> >> -		kfree(bucket);
> >> -	}
> >> -
> >> -	m = rt->fib6_metrics;
> >> -	if (m != &dst_default_metrics && refcount_dec_and_test(&m->refcnt))
> >> -		kfree(m);
> > 
> > You remove this...
> > 
> >>  
> >>  	rt->from = NULL;
> >> -	dst_release(&from->dst);
> >> +	fib6_info_release(from);
> > 
> > Yet fib6_info_release() doesn't take care of it (unlike the IPv4
> > equivalent), which means you're leaking the metrics.
> > 
> >>  }
> 
> ok, I'll take a look. I thought I verified both paths (fib6_info and
> dst) were freeing the metrics.

I get this from kmemleak (applied your patchset on top of fe2d55d295cf):

unreferenced object 0xffff88004e2c16c8 (size 96):
comm "systemd-network", pid 1255, jiffies 4295166424 (age 957.858s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
backtrace:
ip6_route_info_create (/net/ipv6/route.c:2849) 
ip6_route_add (/net/ipv6/route.c:2975) 
inet6_rtm_newroute (/net/ipv6/route.c:4357) 
rtnetlink_rcv_msg (/net/core/rtnetlink.c:4643) 
netlink_rcv_skb (/net/netlink/af_netlink.c:2445) 
netlink_unicast (/net/netlink/af_netlink.c:1309 /net/netlink/af_netlink.c:1334) 
netlink_sendmsg (/net/netlink/af_netlink.c:1897) 
sock_sendmsg (/net/socket.c:630 /net/socket.c:639) 
SYSC_sendto (/net/socket.c:1748) 
do_syscall_64 (/arch/x86/entry/common.c:287) 
entry_SYSCALL_64_after_hwframe (/arch/x86/entry/entry_64.S:239) 
0xffffffffffffffff (/./include/asm-generic/sections.h:42)