svn commit: r294411 - head/sys/netinet6

[Alexander V. Chernikov]

Author: melifaro
Date: Wed Jan 20 11:25:30 2016
New Revision: 294411
URL: https://svnweb.freebsd.org/changeset/base/294411

Log:
  Fix rte refcount leak in ip6_forward().
  
  Reviewed by:	ae
  MFC after:	2 weeks
  Sponsored by:	Yandex LLC

Modified:
  head/sys/netinet6/ip6_forward.c

Modified: head/sys/netinet6/ip6_forward.c
==============================================================================
--- head/sys/netinet6/ip6_forward.c	Wed Jan 20 11:15:54 2016	(r294410)
+++ head/sys/netinet6/ip6_forward.c	Wed Jan 20 11:25:30 2016	(r294411)
@@ -341,6 +341,7 @@ again:
 	dst->sin6_addr = ip6->ip6_dst;
 again2:
 	rin6.ro_rt = in6_rtalloc1((struct sockaddr *)dst, 0, 0, M_GETFIB(m));
+	rt = rin6.ro_rt;
 	if (rin6.ro_rt != NULL)
 		RT_UNLOCK(rin6.ro_rt);
 	else {
@@ -352,7 +353,6 @@ again2:
 		}
 		goto bad;
 	}
-	rt = rin6.ro_rt;
 
 	/*
 	 * Source scope check: if a packet can't be delivered to its
@@ -505,8 +505,10 @@ again2:
 		/* If destination is now ourself drop to ip6_input(). */
 		if (in6_localip(&ip6->ip6_dst))
 			m->m_flags |= M_FASTFWD_OURS;
-		else
+		else {
+			RTFREE(rt);
 			goto again;	/* Redo the routing table lookup. */
+		}
 	}
 
 	/* See if local, if yes, send it to netisr. */
@@ -533,6 +535,7 @@ again2:
 		m->m_flags |= M_SKIP_FIREWALL;
 		m->m_flags &= ~M_IP6_NEXTHOP;
 		m_tag_delete(m, fwd_tag);
+		RTFREE(rt);
 		goto again2;
 	}