net/smc: fix neighbour and rtable leak in smc_ib_find_route()

In smc_ib_find_route(), the neighbour found by neigh_lookup() and rtable
resolved by ip_route_output_flow() are not released or put before return.
It may cause the refcount leak, so fix it.

Link: https://lore.kernel.org/r/20240506015439.108739-1-guwen@linux.alibaba.com
Fixes: e5c4744cfb59 ("net/smc: add SMC-Rv2 connection establishment")
Signed-off-by: Wen Gu <guwen@linux.alibaba.com>
Link: https://lore.kernel.org/r/20240507125331.2808-1-guwen@linux.alibaba.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

diff --git a/net/smc/smc_ib.c b/net/smc/smc_ib.c
index 97704a9e84c701f55750ecd51fa872a726a826ac..9297dc20bfe23718d8031d78185171bb7ce5c31a 100644 (file)
--- a/net/smc/smc_ib.c
+++ b/net/smc/smc_ib.c
@@ -209,13 +209,18 @@ int smc_ib_find_route(struct net *net, __be32 saddr, __be32 daddr,
        if (IS_ERR(rt))
                goto out;
        if (rt->rt_uses_gateway && rt->rt_gw_family != AF_INET)
-               goto out;
-       neigh = rt->dst.ops->neigh_lookup(&rt->dst, NULL, &fl4.daddr);
-       if (neigh) {
-               memcpy(nexthop_mac, neigh->ha, ETH_ALEN);
-               *uses_gateway = rt->rt_uses_gateway;
-               return 0;
-       }
+               goto out_rt;
+       neigh = dst_neigh_lookup(&rt->dst, &fl4.daddr);
+       if (!neigh)
+               goto out_rt;
+       memcpy(nexthop_mac, neigh->ha, ETH_ALEN);
+       *uses_gateway = rt->rt_uses_gateway;
+       neigh_release(neigh);
+       ip_rt_put(rt);
+       return 0;
+
+out_rt:
+       ip_rt_put(rt);
 out:
        return -ENOENT;
 }