iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge tag 'rxrpc-fixes-20211129' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs

Browse Source 
David Howells says:

====================
rxrpc: Leak fixes

Here are a couple of fixes for leaks in AF_RXRPC:

 (1) Fix a leak of rxrpc_peer structs in rxrpc_look_up_bundle().
 (2) Fix a leak of rxrpc_local structs in rxrpc_lookup_peer().

* tag 'rxrpc-fixes-20211129' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs:
  rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer()
  rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle()
====================

Link: https://lore.kernel.org/r/163820097905.226370.17234085194655347888.stgit@warthog.procyon.org.uk
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Jakub Kicinski
2021-11-29 20:04:10 -08:00
parent cbd92e7d74 beacff50ed
commit 5fdc2333e6
2 changed files with 18 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
net/rxrpc/conn_client.c
View File

@ -135,16 +135,20 @@ struct rxrpc_bundle *rxrpc_get_bundle(struct rxrpc_bundle *bundle)
return bundle; return bundle;
} }
static void rxrpc_free_bundle(struct rxrpc_bundle *bundle)
{
rxrpc_put_peer(bundle->params.peer);
kfree(bundle);
}
void rxrpc_put_bundle(struct rxrpc_bundle *bundle) void rxrpc_put_bundle(struct rxrpc_bundle *bundle)
{ {
unsigned int d = bundle->debug_id; unsigned int d = bundle->debug_id;
unsigned int u = atomic_dec_return(&bundle->usage); unsigned int u = atomic_dec_return(&bundle->usage);
_debug("PUT B=%x %u", d, u); _debug("PUT B=%x %u", d, u);
if (u == 0) { if (u == 0)
rxrpc_put_peer(bundle->params.peer); rxrpc_free_bundle(bundle);
kfree(bundle);
}
} }
/* /*
@ -328,7 +332,7 @@ static struct rxrpc_bundle *rxrpc_look_up_bundle(struct rxrpc_conn_parameters *c
return candidate; return candidate;
found_bundle_free: found_bundle_free:
kfree(candidate); rxrpc_free_bundle(candidate);
found_bundle: found_bundle:
rxrpc_get_bundle(bundle); rxrpc_get_bundle(bundle);
spin_unlock(&local->client_bundles_lock); spin_unlock(&local->client_bundles_lock);

14
net/rxrpc/peer_object.c
View File

@ -299,6 +299,12 @@ static struct rxrpc_peer *rxrpc_create_peer(struct rxrpc_sock *rx,
return peer; return peer;
} }
static void rxrpc_free_peer(struct rxrpc_peer *peer)
{
rxrpc_put_local(peer->local);
kfree_rcu(peer, rcu);
}
/* /*
* Set up a new incoming peer. There shouldn't be any other matching peers * Set up a new incoming peer. There shouldn't be any other matching peers
* since we've already done a search in the list from the non-reentrant context * since we've already done a search in the list from the non-reentrant context
@ -365,7 +371,7 @@ struct rxrpc_peer *rxrpc_lookup_peer(struct rxrpc_sock *rx,
spin_unlock_bh(&rxnet->peer_hash_lock); spin_unlock_bh(&rxnet->peer_hash_lock);
if (peer) if (peer)
kfree(candidate); rxrpc_free_peer(candidate);
else else
peer = candidate; peer = candidate;
} }
@ -420,8 +426,7 @@ static void __rxrpc_put_peer(struct rxrpc_peer *peer)
list_del_init(&peer->keepalive_link); list_del_init(&peer->keepalive_link);
spin_unlock_bh(&rxnet->peer_hash_lock); spin_unlock_bh(&rxnet->peer_hash_lock);
rxrpc_put_local(peer->local); rxrpc_free_peer(peer);
kfree_rcu(peer, rcu);
} }
/* /*
@ -457,8 +462,7 @@ void rxrpc_put_peer_locked(struct rxrpc_peer *peer)
if (n == 0) { if (n == 0) {
hash_del_rcu(&peer->hash_link); hash_del_rcu(&peer->hash_link);
list_del_init(&peer->keepalive_link); list_del_init(&peer->keepalive_link);
rxrpc_put_local(peer->local); rxrpc_free_peer(peer);
kfree_rcu(peer, rcu);
} }
} }