aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorRomain KUNTZ <r.kuntz@ipflavors.com>2013-02-18 02:36:24 +0000
committerDavid S. Miller <davem@davemloft.net>2013-02-18 14:57:29 -0500
commit18cf0d0784b4a634472ed24d0d7ca1c721d93e90 (patch)
tree0b7591c785c66a99273fd7b9ec45b05defe17cd4
parentdca9ab9274ab1b01fa2a78d5b82e9d1ea8c22b39 (diff)
downloadvexpress-lsk-18cf0d0784b4a634472ed24d0d7ca1c721d93e90.tar.gz
xfrm: release neighbor upon dst destruction
Neighbor is cloned in xfrm6_fill_dst but seems to never be released. Neighbor entry should be released when XFRM6 dst entry is destroyed in xfrm6_dst_destroy, otherwise references may be kept forever on the device pointed by the neighbor entry. I may not have understood all the subtleties of XFRM & dst so I would be happy to receive comments on this patch. Signed-off-by: Romain Kuntz <r.kuntz@ipflavors.com> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--net/ipv6/xfrm6_policy.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index c9844135c9c..8f32718677b 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -236,6 +236,8 @@ static void xfrm6_dst_destroy(struct dst_entry *dst)
{
struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
+ if (likely(xdst->u.rt6.n))
+ neigh_release(xdst->u.rt6.n);
if (likely(xdst->u.rt6.rt6i_idev))
in6_dev_put(xdst->u.rt6.rt6i_idev);
dst_destroy_metrics_generic(dst);