ipv6: Fix mem leak in rt6i_pcpu
authorMartin KaFai Lau <[email protected]>
Tue, 5 Jul 2016 19:10:23 +0000 (12:10 -0700)
committerDavid S. Miller <[email protected]>
Tue, 5 Jul 2016 21:09:23 +0000 (14:09 -0700)
commit903ce4abdf374e3365d93bcb3df56c62008835ba
tree3b7254712331dcc662a55652f068f26c5003f2e3
parentab58298cf459fcd4f588a401d36abf0bd2215b51
ipv6: Fix mem leak in rt6i_pcpu

It was first reported and reproduced by Petr (thanks!) in
https://bugzilla.kernel.org/show_bug.cgi?id=119581

free_percpu(rt->rt6i_pcpu) used to always happen in ip6_dst_destroy().

However, after fixing a deadlock bug in
commit 9c7370a166b4 ("ipv6: Fix a potential deadlock when creating pcpu rt"),
free_percpu() is not called before setting non_pcpu_rt->rt6i_pcpu to NULL.

It is worth to note that rt6i_pcpu is protected by table->tb6_lock.

kmemleak somehow did not report it.  We nailed it down by
observing the pcpu entries in /proc/vmallocinfo (first suggested
by Hannes, thanks!).

Signed-off-by: Martin KaFai Lau <[email protected]>
Fixes: 9c7370a166b4 ("ipv6: Fix a potential deadlock when creating pcpu rt")
Reported-by: Petr Novopashenniy <[email protected]>
Tested-by: Petr Novopashenniy <[email protected]>
Acked-by: Hannes Frederic Sowa <[email protected]>
Cc: Hannes Frederic Sowa <[email protected]>
Cc: Petr Novopashenniy <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
net/ipv6/ip6_fib.c