2019-08-21 01:08:26

by zhanglin

Subject: [PATCH v2] sock: fix potential memory leak in proto_register()

If protocols registered exceeded PROTO_INUSE_NR, prot will be
added to proto_list, but no available bit left for prot in
proto_inuse_idx.

Signed-off-by: zhanglin <[email protected]>
---
net/core/sock.c | 24 ++++++++++++++++--------
1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/net/core/sock.c b/net/core/sock.c
index bc3512f230a3..c7ae32705705 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -3139,16 +3139,17 @@ static __init int net_inuse_init(void)

core_initcall(net_inuse_init);

-static void assign_proto_idx(struct proto *prot)
+static int assign_proto_idx(struct proto *prot)
{
prot->inuse_idx = find_first_zero_bit(proto_inuse_idx, PROTO_INUSE_NR);

if (unlikely(prot->inuse_idx == PROTO_INUSE_NR - 1)) {
pr_err("PROTO_INUSE_NR exhausted\n");
- return;
+ return -ENOSPC;
}

set_bit(prot->inuse_idx, proto_inuse_idx);
+ return 0;
}

static void release_proto_idx(struct proto *prot)
@@ -3157,8 +3158,9 @@ static void release_proto_idx(struct proto *prot)
clear_bit(prot->inuse_idx, proto_inuse_idx);
}
#else
-static inline void assign_proto_idx(struct proto *prot)
+static inline int assign_proto_idx(struct proto *prot)
{
+ return 0;
}

static inline void release_proto_idx(struct proto *prot)
@@ -3243,18 +3245,24 @@ int proto_register(struct proto *prot, int alloc_slab)
}

mutex_lock(&proto_list_mutex);
+ if (assign_proto_idx(prot)) {
+ mutex_unlock(&proto_list_mutex);
+ goto out_free_timewait_sock_slab_name;
+ }
list_add(&prot->node, &proto_list);
- assign_proto_idx(prot);
mutex_unlock(&proto_list_mutex);
return 0;

out_free_timewait_sock_slab_name:
- kfree(prot->twsk_prot->twsk_slab_name);
+ if (alloc_slab && prot->twsk_prot)
+ kfree(prot->twsk_prot->twsk_slab_name);
out_free_request_sock_slab:
- req_prot_cleanup(prot->rsk_prot);
+ if (alloc_slab) {
+ req_prot_cleanup(prot->rsk_prot);

- kmem_cache_destroy(prot->slab);
- prot->slab = NULL;
+ kmem_cache_destroy(prot->slab);
+ prot->slab = NULL;
+ }
out:
return -ENOBUFS;
}
--
2.17.1

2019-08-23 08:53:41

by David Miller

Subject: Re: [PATCH v2] sock: fix potential memory leak in proto_register()

From: zhanglin <[email protected]>
Date: Wed, 21 Aug 2019 08:42:38 +0800

> @@ -3243,18 +3245,24 @@ int proto_register(struct proto *prot, int alloc_slab)
> }
>
> mutex_lock(&proto_list_mutex);
> + if (assign_proto_idx(prot)) {
> + mutex_unlock(&proto_list_mutex);
> + goto out_free_timewait_sock_slab_name;
> + }

Propagate the error code properly please.