Commit b2aff963 authored Aug 24, 2010 by Julia Lawall Committed by David S. Miller Aug 25, 2010

net/netfilter/ipvs: Eliminate memory leak

__ip_vs_service_get and __ip_vs_svc_fwm_get increment a reference count, so
that reference count should be decremented before leaving the function in an
error case.

A simplified version of the semantic match that finds this problem is:
(http://coccinelle.lip6.fr/

)

// <smpl>
@r exists@
local idexpression x;
expression E;
identifier f1;
iterator I;
@@

x = __ip_vs_service_get(...);
<... when != x
     when != true (x == NULL || ...)
     when != if (...) { <+...x...+> }
     when != I (...) { <+...x...+> }
(
 x == NULL
|
 x == E
|
 x->f1
)
...>
* return ...;
// </smpl>

Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: Simon Horman <horms@verge.net.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 8d34e7d6

net/netfilter/ipvs/ip_vs_ctl.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -2155,7 +2155,7 @@ do_ip_vs_set_ctl(struct sock sk, int cmd, void __user user, unsigned int len)
		if (cmd != IP_VS_SO_SET_ADD
		&& (svc == NULL \|\| svc->protocol != usvc.protocol)) {
		ret = -ESRCH;
		goto out_unlock;
		goto out_drop_service;
		}

		switch (cmd) {
		@@ -2189,6 +2189,7 @@ do_ip_vs_set_ctl(struct sock sk, int cmd, void __user user, unsigned int len)
		ret = -EINVAL;
		}

		out_drop_service:
		if (svc)
		ip_vs_service_put(svc);