ipv6: fix memory leak on dst->_metrics
authorWei Wang <weiwan@google.com>
Tue, 18 Sep 2018 20:45:00 +0000 (13:45 -0700)
committerDavid S. Miller <davem@davemloft.net>
Wed, 19 Sep 2018 03:17:01 +0000 (20:17 -0700)
commitce7ea4af0838ffd4667ecad4eb5eec7a25342f1e
tree196f9e53a53e7aa2c52573c446400640d54f35ad
parent8675860592321a43bbb0b5aedc244a9b2321edc3
ipv6: fix memory leak on dst->_metrics

When dst->_metrics and f6i->fib6_metrics share the same memory, both
take reference count on the dst_metrics structure. However, when dst is
destroyed, ip6_dst_destroy() only invokes dst_destroy_metrics_generic()
which does not take care of READONLY metrics and does not release refcnt.
This causes memory leak.
Similar to ipv4 logic, the fix is to properly release refcnt and free
the memory space pointed by dst->_metrics if refcnt becomes 0.

Fixes: 93531c674315 ("net/ipv6: separate handling of FIB entries from dst based routes")
Reported-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: Wei Wang <weiwan@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv6/route.c