6528779 mdb findleaks reports memory leak in ipfilter

5 files changed, 49 insertions, 25 deletions

diff --git a/usr/src/uts/common/inet/ipf/fil.c b/usr/src/uts/common/inet/ipf/fil.c
index 9c97637d8e..e8732970f1 100644
--- a/usr/src/uts/common/inet/ipf/fil.c
+++ b/usr/src/uts/common/inet/ipf/fil.c
@@ -6628,7 +6628,7 @@ ipf_stack_t *ifs;
 	return error;
 }
 
-static void ipf_unlinktoken(token, ifs)
+void ipf_unlinktoken(token, ifs)
 ipftoken_t *token;
 ipf_stack_t *ifs;
 {
@@ -6785,14 +6785,14 @@ int ipf_getnextrule(ipftoken_t *t, void *ptr, ipf_stack_t *ifs)
 	if (next != NULL) {
 		if (next->fr_next == NULL) {
 			t->ipt_alive = 0;
-			/*ipf_freetoken(t, ifs);
-			fr = NULL; */
+			ipf_unlinktoken(t, ifs);
+			KFREE(t);	
 		} else {
 			MUTEX_ENTER(&next->fr_lock);
 			next->fr_ref++;
 			MUTEX_EXIT(&next->fr_lock);
+			t->ipt_data = next;
 		}
-		t->ipt_data = next;
 	} else {
 		bzero(&zero, sizeof(zero));
 		next = &zero;
diff --git a/usr/src/uts/common/inet/ipf/ip_htable.c b/usr/src/uts/common/inet/ipf/ip_htable.c
index bbb10d93d9..8b0f26532b 100644
--- a/usr/src/uts/common/inet/ipf/ip_htable.c
+++ b/usr/src/uts/common/inet/ipf/ip_htable.c
@@ -668,14 +668,17 @@ ipf_stack_t *ifs;
 		}
 
 		if (nextiph != NULL) {
-			if (nextiph->iph_next == NULL)
+			if (nextiph->iph_next == NULL) {
 				token->ipt_alive = 0;
-			else {
+				ipf_unlinktoken(token, ifs);
+				KFREE(token);
+			} else {
 				ATOMIC_INC(nextiph->iph_ref);
 			}
 		} else {
 			bzero((char *)&zp, sizeof(zp));
 			nextiph = &zp;
+			ipf_freetoken(token, ifs);
 		}
 		break;
 
@@ -693,14 +696,17 @@ ipf_stack_t *ifs;
 		}
 
 		if (nextnode != NULL) {
-			if (nextnode->ipe_snext == NULL)
+			if (nextnode->ipe_snext == NULL) {
 				token->ipt_alive = 0;
-			else {
+				ipf_unlinktoken(token, ifs);
+				KFREE(token);
+			} else {
 				ATOMIC_INC(nextnode->ipe_ref);
 			}
 		} else {
 			bzero((char *)&zn, sizeof(zn));
 			nextnode = &zn;
+			ipf_freetoken(token, ifs);
 		}
 		break;
 	default :
@@ -720,7 +726,9 @@ ipf_stack_t *ifs;
 			fr_derefhtable(iph, ifs);
 			RWLOCK_EXIT(&ifs->ifs_ip_poolrw);
 		}
-		token->ipt_data = nextiph;
+		if (nextiph->iph_next != NULL) 
+			token->ipt_data = nextiph;
+		
 		err = COPYOUT(nextiph, ilp->ili_data, sizeof(*nextiph));
 		if (err != 0)
 			err = EFAULT;
@@ -732,7 +740,8 @@ ipf_stack_t *ifs;
 			fr_derefhtent(node);
 			RWLOCK_EXIT(&ifs->ifs_ip_poolrw);
 		}
-		token->ipt_data = nextnode;
+		if (nextnode->ipe_snext != NULL) 
+			token->ipt_data = nextnode;
 		err = COPYOUT(nextnode, ilp->ili_data, sizeof(*nextnode));
 		if (err != 0)
 			err = EFAULT;
diff --git a/usr/src/uts/common/inet/ipf/ip_nat.c b/usr/src/uts/common/inet/ipf/ip_nat.c
index 8eaa4fe899..4e008bfe9b 100644
--- a/usr/src/uts/common/inet/ipf/ip_nat.c
+++ b/usr/src/uts/common/inet/ipf/ip_nat.c
@@ -5022,8 +5022,8 @@ ipf_stack_t *ifs;
 		if (nexthm != NULL) {
 			if (nexthm->hm_hnext == NULL) {
 				t->ipt_alive = 0;
-				/* ipf_freetoken(t, ifs);
-				hm = NULL; */
+				ipf_unlinktoken(t, ifs);
+				KFREE(t);
 			} else {
 				/*MUTEX_ENTER(&nexthm->hm_lock);*/
 				nexthm->hm_ref++;
@@ -5033,6 +5033,7 @@ ipf_stack_t *ifs;
 		} else {
 			bzero(&zerohm, sizeof(zerohm));
 			nexthm = &zerohm;
+			ipf_freetoken(t, ifs);
 		}
 		break;
 
@@ -5046,8 +5047,8 @@ ipf_stack_t *ifs;
 		if (nextipnat != NULL) {
 			if (nextipnat->in_next == NULL) {
 				t->ipt_alive = 0;
-				/*ipf_freetoken(t, ifs);
-				ipn = NULL;*/
+				ipf_unlinktoken(t, ifs);
+				KFREE(t);
 			} else {
 				/* MUTEX_ENTER(&nextipnat->in_lock); */
 				nextipnat->in_use++;
@@ -5056,6 +5057,7 @@ ipf_stack_t *ifs;
 		} else {
 			bzero(&zeroipn, sizeof(zeroipn));
 			nextipnat = &zeroipn;
+			ipf_freetoken(t, ifs);
 		}
 		break;
 
@@ -5069,8 +5071,8 @@ ipf_stack_t *ifs;
 		if (nextnat != NULL) {
 			if (nextnat->nat_next == NULL) {
 				t->ipt_alive = 0;
-				/*ipf_freetoken(t, ifs);
-				nat = NULL;*/
+				ipf_unlinktoken(t, ifs);
+				KFREE(t);
 			} else {
 				MUTEX_ENTER(&nextnat->nat_lock);
 				nextnat->nat_ref++;
@@ -5079,6 +5081,7 @@ ipf_stack_t *ifs;
 		} else {
 			bzero(&zeronat, sizeof(zeronat));
 			nextnat = &zeronat;
+			ipf_freetoken(t, ifs);
 		}
 		break;
 	}
@@ -5093,7 +5096,8 @@ ipf_stack_t *ifs;
 			fr_hostmapderef(&hm);
 			RWLOCK_EXIT(&ifs->ifs_ipf_nat);
 		}
-		t->ipt_data = nexthm;
+		if (nexthm->hm_hnext != NULL) 
+			t->ipt_data = nexthm;
 		error = COPYOUT(nexthm, itp->igi_data, sizeof(*nexthm));
 		if (error != 0)
 			error = EFAULT;
@@ -5102,7 +5106,8 @@ ipf_stack_t *ifs;
 	case IPFGENITER_IPNAT :
 		if (ipn != NULL)
 			fr_ipnatderef(&ipn, ifs);
-		t->ipt_data = nextipnat;
+		if (nextipnat->in_next != NULL) 
+			t->ipt_data = nextipnat;
 		error = COPYOUT(nextipnat, itp->igi_data, sizeof(*nextipnat));
 		if (error != 0)
 			error = EFAULT;
@@ -5111,7 +5116,8 @@ ipf_stack_t *ifs;
 	case IPFGENITER_NAT :
 		if (nat != NULL)
 			fr_natderef(&nat, ifs);
-		t->ipt_data = nextnat;
+		if (nextnat->nat_next != NULL) 
+			t->ipt_data = nextnat;
 		error = COPYOUT(nextnat, itp->igi_data, sizeof(*nextnat));
 		if (error != 0)
 			error = EFAULT;
diff --git a/usr/src/uts/common/inet/ipf/ip_pool.c b/usr/src/uts/common/inet/ipf/ip_pool.c
index 0bfbf088c2..fb2d551aa1 100644
--- a/usr/src/uts/common/inet/ipf/ip_pool.c
+++ b/usr/src/uts/common/inet/ipf/ip_pool.c
@@ -785,14 +785,17 @@ ipf_stack_t *ifs;
 		}
 
 		if (nextipo != NULL) {
-			if (nextipo->ipo_next == NULL)
+			if (nextipo->ipo_next == NULL) {
 				token->ipt_alive = 0;
-			else {
+				ipf_unlinktoken(token, ifs);
+				KFREE(token);
+			} else {
 				ATOMIC_INC(nextipo->ipo_ref);
 			}
 		} else {
 			bzero((char *)&zp, sizeof(zp));
 			nextipo = &zp;
+			ipf_freetoken(token, ifs);
 		}
 		break;
 
@@ -811,14 +814,17 @@ ipf_stack_t *ifs;
 		}
 
 		if (nextnode != NULL) {
-			if (nextnode->ipn_next == NULL)
+			if (nextnode->ipn_next == NULL) {
 				token->ipt_alive = 0;
-			else {
+				ipf_unlinktoken(token, ifs);
+				KFREE(token);
+			} else {
 				ATOMIC_INC(nextnode->ipn_ref);
 			}
 		} else {
 			bzero((char *)&zn, sizeof(zn));
 			nextnode = &zn;
+			ipf_freetoken(token, ifs);
 		}
 		break;
 	default :
@@ -839,7 +845,8 @@ ipf_stack_t *ifs;
 			ip_pool_deref(ipo, ifs);
 			RWLOCK_EXIT(&ifs->ifs_ip_poolrw);
 		}
-		token->ipt_data = nextipo;
+		if (nextipo->ipo_next != NULL) 
+			token->ipt_data = nextipo;
 		err = COPYOUT(nextipo, ilp->ili_data, sizeof(*nextipo));
 		if (err != 0)
 			err = EFAULT;
@@ -851,7 +858,8 @@ ipf_stack_t *ifs;
 			ip_pool_node_deref(node, ifs);
 			RWLOCK_EXIT(&ifs->ifs_ip_poolrw);
 		}
-		token->ipt_data = nextnode;
+		if (nextnode->ipn_next != NULL) 
+			token->ipt_data = nextnode;
 		err = COPYOUT(nextnode, ilp->ili_data, sizeof(*nextnode));
 		if (err != 0)
 			err = EFAULT;
diff --git a/usr/src/uts/common/inet/ipf/netinet/ip_fil.h b/usr/src/uts/common/inet/ipf/netinet/ip_fil.h
index 2e40abe061..d72e3ca7e8 100644
--- a/usr/src/uts/common/inet/ipf/netinet/ip_fil.h
+++ b/usr/src/uts/common/inet/ipf/netinet/ip_fil.h
@@ -1467,6 +1467,7 @@ extern	int		fr_zerostats __P((char *, ipf_stack_t *));
 extern  ipftoken_t      *ipf_findtoken __P((int, int, void *, ipf_stack_t *));
 extern  int             ipf_getnextrule __P((ipftoken_t *, void *, ipf_stack_t *));
 extern  void            ipf_expiretokens __P((ipf_stack_t *));
+extern  void            ipf_unlinktoken __P((ipftoken_t *, ipf_stack_t *));
 extern  void            ipf_freetoken __P((ipftoken_t *, ipf_stack_t *));
 extern  int             ipf_deltoken __P((int,int, void *, ipf_stack_t *));
 extern  int             ipf_genericiter __P((void *, int, void *, ipf_stack_t *));