Commit 5fdc2333 authored by Jakub Kicinski's avatar Jakub Kicinski

Merge tag 'rxrpc-fixes-20211129' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs

David Howells says:

====================
rxrpc: Leak fixes

Here are a couple of fixes for leaks in AF_RXRPC:

 (1) Fix a leak of rxrpc_peer structs in rxrpc_look_up_bundle().
 (2) Fix a leak of rxrpc_local structs in rxrpc_lookup_peer().

* tag 'rxrpc-fixes-20211129' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs:
  rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer()
  rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle()
====================

Link: https://lore.kernel.org/r/163820097905.226370.17234085194655347888.stgit@warthog.procyon.org.ukSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents cbd92e7d beacff50
......@@ -135,16 +135,20 @@ struct rxrpc_bundle *rxrpc_get_bundle(struct rxrpc_bundle *bundle)
return bundle;
}
static void rxrpc_free_bundle(struct rxrpc_bundle *bundle)
{
rxrpc_put_peer(bundle->params.peer);
kfree(bundle);
}
void rxrpc_put_bundle(struct rxrpc_bundle *bundle)
{
unsigned int d = bundle->debug_id;
unsigned int u = atomic_dec_return(&bundle->usage);
_debug("PUT B=%x %u", d, u);
if (u == 0) {
rxrpc_put_peer(bundle->params.peer);
kfree(bundle);
}
if (u == 0)
rxrpc_free_bundle(bundle);
}
/*
......@@ -328,7 +332,7 @@ static struct rxrpc_bundle *rxrpc_look_up_bundle(struct rxrpc_conn_parameters *c
return candidate;
found_bundle_free:
kfree(candidate);
rxrpc_free_bundle(candidate);
found_bundle:
rxrpc_get_bundle(bundle);
spin_unlock(&local->client_bundles_lock);
......
......@@ -299,6 +299,12 @@ static struct rxrpc_peer *rxrpc_create_peer(struct rxrpc_sock *rx,
return peer;
}
static void rxrpc_free_peer(struct rxrpc_peer *peer)
{
rxrpc_put_local(peer->local);
kfree_rcu(peer, rcu);
}
/*
* Set up a new incoming peer. There shouldn't be any other matching peers
* since we've already done a search in the list from the non-reentrant context
......@@ -365,7 +371,7 @@ struct rxrpc_peer *rxrpc_lookup_peer(struct rxrpc_sock *rx,
spin_unlock_bh(&rxnet->peer_hash_lock);
if (peer)
kfree(candidate);
rxrpc_free_peer(candidate);
else
peer = candidate;
}
......@@ -420,8 +426,7 @@ static void __rxrpc_put_peer(struct rxrpc_peer *peer)
list_del_init(&peer->keepalive_link);
spin_unlock_bh(&rxnet->peer_hash_lock);
rxrpc_put_local(peer->local);
kfree_rcu(peer, rcu);
rxrpc_free_peer(peer);
}
/*
......@@ -457,8 +462,7 @@ void rxrpc_put_peer_locked(struct rxrpc_peer *peer)
if (n == 0) {
hash_del_rcu(&peer->hash_link);
list_del_init(&peer->keepalive_link);
rxrpc_put_local(peer->local);
kfree_rcu(peer, rcu);
rxrpc_free_peer(peer);
}
}
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment