linux/net
Ying Xue 4652edb70e tipc: fix connection refcount leak
When tipc_conn_sendmsg() calls tipc_conn_lookup() to query a
connection instance, its reference count value is increased if
it's found. But subsequently if it's found that the connection is
closed, the work of sending message is not queued into its server
send workqueue, and the connection reference count is not decreased.
This will cause a reference count leak. To reproduce this problem,
an application would need to open and closes topology server
connections with high intensity.

We fix this by immediately decrementing the connection reference
count if a send fails due to the connection being closed.

Signed-off-by: Ying Xue <ying.xue@windriver.com>
Acked-by: Erik Hugne <erik.hugne@ericsson.com>
Reviewed-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-03-06 14:46:23 -05:00
..
9p 9p/trans_virtio.c: Fix broken zero-copy on vmalloc() buffers 2014-02-10 17:48:54 -08:00
802
8021q
appletalk
atm
ax25
batman-adv batman-adv: fix potential kernel paging error for unicast transmissions 2014-02-17 17:17:02 +01:00
bluetooth Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid 2014-02-18 16:29:46 -08:00
bridge bridge: multicast: add sanity check for query source addresses 2014-03-05 20:40:24 -05:00
caif net: Include appropriate header file in caif/cfsrvl.c 2014-02-09 17:32:49 -08:00
can can: remove CAN FD compatibility for CAN 2.0 sockets 2014-03-03 14:29:52 +01:00
ceph libceph: do not dereference a NULL bio pointer 2014-02-07 11:37:07 -08:00
core neigh: recompute reachabletime before returning from neigh_periodic_work() 2014-02-27 18:21:17 -05:00
dcb
dccp dccp: re-enable debug macro 2014-02-16 23:45:00 -05:00
decnet net: Move prototype declaration to header file include/net/dn.h from net/decnet/af_decnet.c 2014-02-09 17:32:49 -08:00
dns_resolver
dsa
ethernet
hsr hsr: off by one sanity check in hsr_register_frame_in() 2014-03-03 15:29:42 -05:00
ieee802154 6lowpan: fix lockdep splats 2014-02-10 17:51:29 -08:00
ipv4 net: fix for a race condition in the inet frag code 2014-03-05 20:31:42 -05:00
ipv6 ipv6: ipv6_find_hdr restore prev functionality 2014-02-27 18:27:26 -05:00
ipx net: Move prototype declaration to header file include/net/net_namespace.h from net/ipx/af_ipx.c 2014-02-09 17:32:50 -08:00
irda
iucv
key
l2tp l2tp: fix userspace reception on plain L2TP sockets 2014-03-06 14:25:39 -05:00
lapb
llc
mac80211 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem 2014-03-03 14:34:45 -05:00
mac802154
mpls
netfilter netfilter: ctnetlink: force null nat binding on insert 2014-02-18 00:13:51 +01:00
netlabel
netlink net: Fix permission check in netlink_connect() 2014-02-25 18:35:14 -05:00
netrom
nfc NFC: NCI: Fix NULL pointer dereference 2014-02-23 23:14:45 +01:00
openvswitch openvswitch: Suppress error messages on megaflow updates 2014-02-04 22:32:38 -08:00
packet af_packet: remove a stray tab in packet_set_ring() 2014-02-18 18:02:25 -05:00
phonet
rds
rfkill
rose
rxrpc
sched sch_tbf: Fix potential memory leak in tbf_change(). 2014-02-27 12:53:50 -05:00
sctp net: sctp: fix skb leakage in COOKIE ECHO path of chunk->auth_chunk 2014-03-05 20:40:25 -05:00
sunrpc NFS client bugfixes for Linux 3.14 2014-02-19 12:13:02 -08:00
tipc tipc: fix connection refcount leak 2014-03-06 14:46:23 -05:00
unix
vmw_vsock
wimax
wireless cfg80211: regulatory: reset regdomain in case of error 2014-02-25 16:27:04 +01:00
x25
xfrm xfrm: Fix unlink race when policies are deleted. 2014-02-26 09:52:02 +01:00
compat.c x86, x32: Correct invalid use of user timespec in the kernel 2014-01-30 18:44:13 -08:00
Kconfig
Makefile
nonet.c
socket.c
sysctl_net.c