• Hannes Frederic Sowa's avatar
    ipv6: replacing a rt6_info needs to purge possible propagated rt6_infos too · 6e9e16e6
    Hannes Frederic Sowa authored
    Lubomir Rintel reported that during replacing a route the interface
    reference counter isn't correctly decremented.
    
    To quote bug <https://bugzilla.kernel.org/show_bug.cgi?id=91941>:
    | [root@rhel7-5 lkundrak]# sh -x lal
    | + ip link add dev0 type dummy
    | + ip link set dev0 up
    | + ip link add dev1 type dummy
    | + ip link set dev1 up
    | + ip addr add 2001:db8:8086::2/64 dev dev0
    | + ip route add 2001:db8:8086::/48 dev dev0 proto static metric 20
    | + ip route add 2001:db8:8088::/48 dev dev1 proto static metric 10
    | + ip route replace 2001:db8:8086::/48 dev dev1 proto static metric 20
    | + ip link del dev0 type dummy
    | Message from syslogd@rhel7-5 at Jan 23 10:54:41 ...
    |  kernel:unregister_netdevice: waiting for dev0 to become free. Usage count = 2
    |
    | Message from syslogd@rhel7-5 at Jan 23 10:54:51 ...
    |  kernel:unregister_netdevice: waiting for dev0 to become free. Usage count = 2
    
    During replacement of a rt6_info we must walk all parent nodes and check
    if the to be replaced rt6_info got propagated. If so, replace it with
    an alive one.
    
    Fixes: 4a287eba ("IPv6 routing, NLM_F_* flag support: REPLACE and EXCL flags support, warn about missing CREATE flag")
    Reported-by: default avatarLubomir Rintel <lkundrak@v3.sk>
    Signed-off-by: default avatarHannes Frederic Sowa <hannes@stressinduktion.org>
    Tested-by: default avatarLubomir Rintel <lkundrak@v3.sk>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    6e9e16e6
ip6_fib.c 43 KB