]> git.baikalelectronics.ru Git - kernel.git/commit
ipv6: do not free rt if FIB_LOOKUP_NOREF is set on suppress rule
authorJason A. Donenfeld <Jason@zx2c4.com>
Tue, 24 Sep 2019 14:01:28 +0000 (16:01 +0200)
committerDavid S. Miller <davem@davemloft.net>
Thu, 26 Sep 2019 07:34:25 +0000 (09:34 +0200)
commit44308a9c2d23ac1dfac7f3d94f7c9efcab5a51c2
treeaf1034612ac5d258235529d3126c045bbfe0b570
parente3484cba397db86a87925b8b77382d99e72825f4
ipv6: do not free rt if FIB_LOOKUP_NOREF is set on suppress rule

Commit 1c12f13a5467 removed references from certain dsts, but accounting
for this never translated down into the fib6 suppression code. This bug
was triggered by WireGuard users who use wg-quick(8), which uses the
"suppress-prefix" directive to ip-rule(8) for routing all of their
internet traffic without routing loops. The test case added here
causes the reference underflow by causing packets to evaluate a suppress
rule.

Fixes: 1c12f13a5467 ("ipv6: convert major tx path to use RT6_LOOKUP_F_DST_NOREF")
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Acked-by: Wei Wang <weiwan@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv6/fib6_rules.c
tools/testing/selftests/net/fib_tests.sh