From ec216fe2d2cefdfbf22c1e7aa0935c00cddfd627 Mon Sep 17 00:00:00 2001 From: bluhm Date: Sun, 9 Jul 2023 19:06:48 +0000 Subject: [PATCH] Fix route entry leak. In in6_ifdetach() two struct rtentry were leaked. This was triggered by regress/sbin/route and detected with btrace(8) refcnt. The reference returned by rtalloc() must be freed with rtfree() in all cases. OK phessler@ mvs@ --- sys/netinet6/in6_ifattach.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/sys/netinet6/in6_ifattach.c b/sys/netinet6/in6_ifattach.c index 49b8bc76c35..3d7ced8f752 100644 --- a/sys/netinet6/in6_ifattach.c +++ b/sys/netinet6/in6_ifattach.c @@ -1,4 +1,4 @@ -/* $OpenBSD: in6_ifattach.c,v 1.121 2022/11/15 18:42:46 claudio Exp $ */ +/* $OpenBSD: in6_ifattach.c,v 1.122 2023/07/09 19:06:48 bluhm Exp $ */ /* $KAME: in6_ifattach.c,v 1.124 2001/07/18 08:32:51 jinmei Exp $ */ /* @@ -440,10 +440,9 @@ in6_ifdetach(struct ifnet *ifp) sin6.sin6_addr = in6addr_intfacelocal_allnodes; sin6.sin6_addr.s6_addr16[1] = htons(ifp->if_index); rt = rtalloc(sin6tosa(&sin6), 0, ifp->if_rdomain); - if (rt && rt->rt_ifidx == ifp->if_index) { + if (rt && rt->rt_ifidx == ifp->if_index) rtdeletemsg(rt, ifp, ifp->if_rdomain); - rtfree(rt); - } + rtfree(rt); /* remove route to link-local allnodes multicast (ff02::1) */ bzero(&sin6, sizeof(sin6)); @@ -452,10 +451,9 @@ in6_ifdetach(struct ifnet *ifp) sin6.sin6_addr = in6addr_linklocal_allnodes; sin6.sin6_addr.s6_addr16[1] = htons(ifp->if_index); rt = rtalloc(sin6tosa(&sin6), 0, ifp->if_rdomain); - if (rt && rt->rt_ifidx == ifp->if_index) { + if (rt && rt->rt_ifidx == ifp->if_index) rtdeletemsg(rt, ifp, ifp->if_rdomain); - rtfree(rt); - } + rtfree(rt); if (ifp->if_xflags & (IFXF_AUTOCONF6 | IFXF_AUTOCONF6TEMP)) ifp->if_xflags &= ~(IFXF_AUTOCONF6 | IFXF_AUTOCONF6TEMP); -- 2.20.1