Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 913c24af authored by Eiichi Tsukata's avatar Eiichi Tsukata Committed by Greg Kroah-Hartman
Browse files

rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer() 



commit beacff50edbd6c9659a6f15fc7f6126909fade29 upstream.

Need to call rxrpc_put_local() for peer candidate before kfree() as it
holds a ref to rxrpc_local.

[DH: v2: Changed to abstract the peer freeing code out into a function]

Fixes: 9ebeddef58c4 ("rxrpc: rxrpc_peer needs to hold a ref on the rxrpc_local record")
Signed-off-by: default avatarEiichi Tsukata <eiichi.tsukata@nutanix.com>
Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
Reviewed-by: default avatarMarc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Link: https://lore.kernel.org/all/20211121041608.133740-2-eiichi.tsukata@nutanix.com/

 # v1
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 676dc7d9

net/rxrpc/peer_object.c

+9 −5
Original line number Diff line number Diff line
@@ -299,6 +299,12 @@ static struct rxrpc_peer *rxrpc_create_peer(struct rxrpc_sock *rx, 
	return peer;

}



static void rxrpc_free_peer(struct rxrpc_peer *peer)

{

	rxrpc_put_local(peer->local);

	kfree_rcu(peer, rcu);

}



/*

 * Set up a new incoming peer.  There shouldn't be any other matching peers

 * since we've already done a search in the list from the non-reentrant context
@@ -365,7 +371,7 @@ struct rxrpc_peer *rxrpc_lookup_peer(struct rxrpc_sock *rx, 
		spin_unlock_bh(&rxnet->peer_hash_lock);



		if (peer)

			kfree(candidate);

			rxrpc_free_peer(candidate);

		else

			peer = candidate;

	}
@@ -420,8 +426,7 @@ static void __rxrpc_put_peer(struct rxrpc_peer *peer) 
	list_del_init(&peer->keepalive_link);

	spin_unlock_bh(&rxnet->peer_hash_lock);



	rxrpc_put_local(peer->local);

	kfree_rcu(peer, rcu);

	rxrpc_free_peer(peer);

}



/*
@@ -457,8 +462,7 @@ void rxrpc_put_peer_locked(struct rxrpc_peer *peer) 
	if (n == 0) {

		hash_del_rcu(&peer->hash_link);

		list_del_init(&peer->keepalive_link);

		rxrpc_put_local(peer->local);

		kfree_rcu(peer, rcu);

		rxrpc_free_peer(peer);

	}

}