Commit ca77fba8 authored by Eiichi Tsukata's avatar Eiichi Tsukata Committed by David Howells
Browse files

rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle() 



Need to call rxrpc_put_peer() for bundle candidate before kfree() as it
holds a ref to rxrpc_peer.

[DH: v2: Changed to abstract out the bundle freeing code into a function]

Fixes: 245500d8 ("rxrpc: Rewrite the client connection manager")
Signed-off-by: default avatarEiichi Tsukata <eiichi.tsukata@nutanix.com>
Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
Reviewed-by: default avatarMarc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Link: https://lore.kernel.org/r/20211121041608.133740-1-eiichi.tsukata@nutanix.com/ # v1
parent 619ca0d0

net/rxrpc/conn_client.c

+9 −5
Original line number Diff line number Diff line
@@ -135,16 +135,20 @@ struct rxrpc_bundle *rxrpc_get_bundle(struct rxrpc_bundle *bundle) 
	return bundle;

}



static void rxrpc_free_bundle(struct rxrpc_bundle *bundle)

{

	rxrpc_put_peer(bundle->params.peer);

	kfree(bundle);

}



void rxrpc_put_bundle(struct rxrpc_bundle *bundle)

{

	unsigned int d = bundle->debug_id;

	unsigned int u = atomic_dec_return(&bundle->usage);



	_debug("PUT B=%x %u", d, u);

	if (u == 0) {

		rxrpc_put_peer(bundle->params.peer);

		kfree(bundle);

	}

	if (u == 0)

		rxrpc_free_bundle(bundle);

}



/*
@@ -328,7 +332,7 @@ static struct rxrpc_bundle *rxrpc_look_up_bundle(struct rxrpc_conn_parameters *c 
	return candidate;



found_bundle_free:

	kfree(candidate);

	rxrpc_free_bundle(candidate);

found_bundle:

	rxrpc_get_bundle(bundle);

	spin_unlock(&local->client_bundles_lock);