svn commit: r236501 - head/sys/netinet6

[Maksim Yevmenkin]

Author: emax
Date: Sun Jun  3 07:36:59 2012
New Revision: 236501
URL: http://svn.freebsd.org/changeset/base/236501

Log:
  Plug reference leak.
  
  Interface routes are refcounted as packets move through the stack,
  and there's garbage collection tied to it so that route changes can
  safely propagate while traffic is flowing. In our setup, we weren't
  changing or deleting any routes, but the refcounting logic in
  ip6_input() was wrong and caused a reference leak on every inbound
  V6 packet. This eventually caused a 32bit overflow, and the resulting
  0 value caused the garbage collection to run on the active route.
  That then snowballed into the panic.
  
  Reviewed by:	scottl
  MFC after:	3 days

Modified:
  head/sys/netinet6/ip6_input.c

Modified: head/sys/netinet6/ip6_input.c
==============================================================================
--- head/sys/netinet6/ip6_input.c	Sun Jun  3 06:57:47 2012	(r236500)
+++ head/sys/netinet6/ip6_input.c	Sun Jun  3 07:36:59 2012	(r236501)
@@ -879,19 +879,23 @@ passin:
 	 * as our interface address (e.g. multicast addresses, addresses
 	 * within FAITH prefixes and such).
 	 */
-	if (deliverifp && !ip6_getdstifaddr(m)) {
+	if (deliverifp) {
 		struct in6_ifaddr *ia6;
 
-		ia6 = in6_ifawithifp(deliverifp, &ip6->ip6_dst);
-		if (ia6) {
-			if (!ip6_setdstifaddr(m, ia6)) {
-				/*
-				 * XXX maybe we should drop the packet here,
-				 * as we could not provide enough information
-				 * to the upper layers.
-				 */
-			}
+ 		if ((ia6 = ip6_getdstifaddr(m)) != NULL) {
 			ifa_free(&ia6->ia_ifa);
+		} else {
+			ia6 = in6_ifawithifp(deliverifp, &ip6->ip6_dst);
+			if (ia6) {
+				if (!ip6_setdstifaddr(m, ia6)) {
+					/*
+					 * XXX maybe we should drop the packet here,
+					 * as we could not provide enough information
+					 * to the upper layers.
+					 */
+				}
+				ifa_free(&ia6->ia_ifa);
+			}
 		}
 	}