Commit 5fdc2333 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge tag 'rxrpc-fixes-20211129' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs 

David Howells says:

====================
rxrpc: Leak fixes

Here are a couple of fixes for leaks in AF_RXRPC:

 (1) Fix a leak of rxrpc_peer structs in rxrpc_look_up_bundle().
 (2) Fix a leak of rxrpc_local structs in rxrpc_lookup_peer().

* tag 'rxrpc-fixes-20211129' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs:
  rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer()
  rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle()
====================

Link: https://lore.kernel.org/r/163820097905.226370.17234085194655347888.stgit@warthog.procyon.org.uk


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents cbd92e7d beacff50

net/rxrpc/conn_client.c

+9 −5
Original line number Diff line number Diff line
@@ -135,16 +135,20 @@ struct rxrpc_bundle *rxrpc_get_bundle(struct rxrpc_bundle *bundle) 
	return bundle;

}



static void rxrpc_free_bundle(struct rxrpc_bundle *bundle)

{

	rxrpc_put_peer(bundle->params.peer);

	kfree(bundle);

}



void rxrpc_put_bundle(struct rxrpc_bundle *bundle)

{

	unsigned int d = bundle->debug_id;

	unsigned int u = atomic_dec_return(&bundle->usage);



	_debug("PUT B=%x %u", d, u);

	if (u == 0) {

		rxrpc_put_peer(bundle->params.peer);

		kfree(bundle);

	}

	if (u == 0)

		rxrpc_free_bundle(bundle);

}



/*
@@ -328,7 +332,7 @@ static struct rxrpc_bundle *rxrpc_look_up_bundle(struct rxrpc_conn_parameters *c 
	return candidate;



found_bundle_free:

	kfree(candidate);

	rxrpc_free_bundle(candidate);

found_bundle:

	rxrpc_get_bundle(bundle);

	spin_unlock(&local->client_bundles_lock);

net/rxrpc/peer_object.c

+9 −5
Original line number Diff line number Diff line
@@ -299,6 +299,12 @@ static struct rxrpc_peer *rxrpc_create_peer(struct rxrpc_sock *rx, 
	return peer;

}



static void rxrpc_free_peer(struct rxrpc_peer *peer)

{

	rxrpc_put_local(peer->local);

	kfree_rcu(peer, rcu);

}



/*

 * Set up a new incoming peer.  There shouldn't be any other matching peers

 * since we've already done a search in the list from the non-reentrant context
@@ -365,7 +371,7 @@ struct rxrpc_peer *rxrpc_lookup_peer(struct rxrpc_sock *rx, 
		spin_unlock_bh(&rxnet->peer_hash_lock);



		if (peer)

			kfree(candidate);

			rxrpc_free_peer(candidate);

		else

			peer = candidate;

	}
@@ -420,8 +426,7 @@ static void __rxrpc_put_peer(struct rxrpc_peer *peer) 
	list_del_init(&peer->keepalive_link);

	spin_unlock_bh(&rxnet->peer_hash_lock);



	rxrpc_put_local(peer->local);

	kfree_rcu(peer, rcu);

	rxrpc_free_peer(peer);

}



/*
@@ -457,8 +462,7 @@ void rxrpc_put_peer_locked(struct rxrpc_peer *peer) 
	if (n == 0) {

		hash_del_rcu(&peer->hash_link);

		list_del_init(&peer->keepalive_link);

		rxrpc_put_local(peer->local);

		kfree_rcu(peer, rcu);

		rxrpc_free_peer(peer);

	}

}