Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 02618095 authored by Miaohe Lin's avatar Miaohe Lin Committed by Greg Kroah-Hartman
Browse files

net: Fix potential memory leak in proto_register() 



[ Upstream commit 0f5907af39137f8183ed536aaa00f322d7365130 ]

If we failed to assign proto idx, we free the twsk_slab_name but forget to
free the twsk_slab. Add a helper function tw_prot_cleanup() to free these
together and also use this helper function in proto_unregister().

Fixes: b45ce321 ("sock: fix potential memory leak in proto_register()")
Signed-off-by: default avatarMiaohe Lin <linmiaohe@huawei.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent f6c5d9f3

net/core/sock.c

+15 −10
Original line number Diff line number Diff line
@@ -3337,6 +3337,16 @@ static void sock_inuse_add(struct net *net, int val) 
}

#endif



static void tw_prot_cleanup(struct timewait_sock_ops *twsk_prot)

{

	if (!twsk_prot)

		return;

	kfree(twsk_prot->twsk_slab_name);

	twsk_prot->twsk_slab_name = NULL;

	kmem_cache_destroy(twsk_prot->twsk_slab);

	twsk_prot->twsk_slab = NULL;

}



static void req_prot_cleanup(struct request_sock_ops *rsk_prot)

{

	if (!rsk_prot)
@@ -3407,7 +3417,7 @@ int proto_register(struct proto *prot, int alloc_slab) 
						  prot->slab_flags,

						  NULL);

			if (prot->twsk_prot->twsk_slab == NULL)

				goto out_free_timewait_sock_slab_name;

				goto out_free_timewait_sock_slab;

		}

	}
@@ -3415,15 +3425,15 @@ int proto_register(struct proto *prot, int alloc_slab) 
	ret = assign_proto_idx(prot);

	if (ret) {

		mutex_unlock(&proto_list_mutex);

		goto out_free_timewait_sock_slab_name;

		goto out_free_timewait_sock_slab;

	}

	list_add(&prot->node, &proto_list);

	mutex_unlock(&proto_list_mutex);

	return ret;



out_free_timewait_sock_slab_name:

out_free_timewait_sock_slab:

	if (alloc_slab && prot->twsk_prot)

		kfree(prot->twsk_prot->twsk_slab_name);

		tw_prot_cleanup(prot->twsk_prot);

out_free_request_sock_slab:

	if (alloc_slab) {

		req_prot_cleanup(prot->rsk_prot);
@@ -3447,12 +3457,7 @@ void proto_unregister(struct proto *prot) 
	prot->slab = NULL;



	req_prot_cleanup(prot->rsk_prot);



	if (prot->twsk_prot != NULL && prot->twsk_prot->twsk_slab != NULL) {

		kmem_cache_destroy(prot->twsk_prot->twsk_slab);

		kfree(prot->twsk_prot->twsk_slab_name);

		prot->twsk_prot->twsk_slab = NULL;

	}

	tw_prot_cleanup(prot->twsk_prot);

}

EXPORT_SYMBOL(proto_unregister);