• Ido Schimmel's avatar
    netdevsim: fib: Fix reference count leak on route deletion failure · 180a6a3e
    Ido Schimmel authored
    As part of FIB offload simulation, netdevsim stores IPv4 and IPv6 routes
    and holds a reference on FIB info structures that in turn hold a
    reference on the associated nexthop device(s).
    
    In the unlikely case where we are unable to allocate memory to process a
    route deletion request, netdevsim will not release the reference from
    the associated FIB info structure, thereby preventing the associated
    nexthop device(s) from ever being removed [1].
    
    Fix this by scheduling a work item that will flush netdevsim's FIB table
    upon route deletion failure. This will cause netdevsim to release its
    reference from all the FIB info structures in its table.
    
    Reported by Lucas Leong of Trend Micro Zero Day Initiative.
    
    Fixes: 0ae3eb7b ("netdevsim: fib: Perform the route programming in a non-atomic context")
    Signed-off-by: default avatarIdo Schimmel <idosch@nvidia.com>
    Reviewed-by: default avatarAmit Cohen <amcohen@nvidia.com>
    Reviewed-by: default avatarDavid Ahern <dsahern@kernel.org>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    180a6a3e
fib.c 40.1 KB