Page MenuHomeFreeBSD

Plug an ifaddr leak when changing a route's src
ClosedPublic

Authored by rstone on Dec 7 2017, 9:50 PM.
Tags
None
Referenced Files
Unknown Object (File)
Wed, Oct 8, 1:25 PM
Unknown Object (File)
Sat, Oct 4, 5:02 AM
Unknown Object (File)
Fri, Sep 26, 2:03 PM
Unknown Object (File)
Sep 15 2025, 12:19 PM
Unknown Object (File)
Sep 15 2025, 9:25 AM
Unknown Object (File)
Sep 15 2025, 4:21 AM
Unknown Object (File)
Sep 11 2025, 8:08 AM
Unknown Object (File)
Sep 10 2025, 11:32 AM
Subscribers

Details

Summary

If a route is modified in a way that changes the route's source
address (i.e. the address used to access the gateway), then a
reference on the ifaddr representing the old source address will
be leaked if the address type does not have an ifa_rtrequest
method defined. Plug the leak by releasing the reference in
all cases.

Test Plan

I wrote this script to demonstrate the bug:

https://people.freebsd.org/~rstone/route-change-leak

On a stock -head system, I see the number of allocated entries in the ifaddr malloc type go up 100 every time I execute the script. With the fix, the number of allocated entries remains stable as expected.

Diff Detail

Lint
Lint Passed
Unit
No Test Coverage
Build Status
Buildable 13422
Build 13652: arc lint + arc unit

Event Timeline

It would be nice if you describe why this leak happens, i.e. where leaked reference was acquired.

In D13417#281628, @ae wrote:

It would be nice if you describe why this leak happens, i.e. where leaked reference was acquired.

The reference is acquired at line 1800 in this file.

From quick look, it seems ifa_rtrequest does not release this reference and the change is correct.

This revision is now accepted and ready to land.Dec 14 2017, 12:05 PM
This revision was automatically updated to reflect the committed changes.