redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

sock: fix potential memory leak in proto_register() 

If protocols registered exceeded PROTO_INUSE_NR, prot will be
added to proto_list, but no available bit left for prot in
proto_inuse_idx.

Changes since v2:
* Propagate the error code properly

Signed-off-by: zhanglin <zhang.lin16@zte.com.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>
alistair/sunxi64-5.4-dsi
zhanglin 2019-08-23 09:14:11 +08:00 committed by David S. Miller
parent d37fb9758f
commit b45ce32135
1 changed files with 21 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
net/core/sock.c
View File

@ -3287,16 +3287,17 @@ static __init int net_inuse_init(void)
core_initcall(net_inuse_init); core_initcall(net_inuse_init);
static void assign_proto_idx(struct proto *prot) static int assign_proto_idx(struct proto *prot)
{ {
prot->inuse_idx = find_first_zero_bit(proto_inuse_idx, PROTO_INUSE_NR); prot->inuse_idx = find_first_zero_bit(proto_inuse_idx, PROTO_INUSE_NR);
if (unlikely(prot->inuse_idx == PROTO_INUSE_NR - 1)) { if (unlikely(prot->inuse_idx == PROTO_INUSE_NR - 1)) {
pr_err("PROTO_INUSE_NR exhausted\n"); pr_err("PROTO_INUSE_NR exhausted\n");
return; return -ENOSPC;
} }
set_bit(prot->inuse_idx, proto_inuse_idx); set_bit(prot->inuse_idx, proto_inuse_idx);
return 0;
} }
static void release_proto_idx(struct proto *prot) static void release_proto_idx(struct proto *prot)
@ -3305,8 +3306,9 @@ static void release_proto_idx(struct proto *prot)
clear_bit(prot->inuse_idx, proto_inuse_idx); clear_bit(prot->inuse_idx, proto_inuse_idx);
} }
#else #else
static inline void assign_proto_idx(struct proto *prot) static inline int assign_proto_idx(struct proto *prot)
{ {
return 0;
} }
static inline void release_proto_idx(struct proto *prot) static inline void release_proto_idx(struct proto *prot)
@ -3355,6 +3357,8 @@ static int req_prot_init(const struct proto *prot)
int proto_register(struct proto *prot, int alloc_slab) int proto_register(struct proto *prot, int alloc_slab)
{ {
int ret = -ENOBUFS;
if (alloc_slab) { if (alloc_slab) {
prot->slab = kmem_cache_create_usercopy(prot->name, prot->slab = kmem_cache_create_usercopy(prot->name,
prot->obj_size, 0, prot->obj_size, 0,
@ -3391,20 +3395,27 @@ int proto_register(struct proto *prot, int alloc_slab)
} }
mutex_lock(&proto_list_mutex); mutex_lock(&proto_list_mutex);
ret = assign_proto_idx(prot);
if (ret) {
mutex_unlock(&proto_list_mutex);
goto out_free_timewait_sock_slab_name;
}
list_add(&prot->node, &proto_list); list_add(&prot->node, &proto_list);
assign_proto_idx(prot);
mutex_unlock(&proto_list_mutex); mutex_unlock(&proto_list_mutex);
return 0; return ret;
out_free_timewait_sock_slab_name: out_free_timewait_sock_slab_name:
kfree(prot->twsk_prot->twsk_slab_name); if (alloc_slab && prot->twsk_prot)
kfree(prot->twsk_prot->twsk_slab_name);
out_free_request_sock_slab: out_free_request_sock_slab:
req_prot_cleanup(prot->rsk_prot); if (alloc_slab) {
req_prot_cleanup(prot->rsk_prot);
kmem_cache_destroy(prot->slab); kmem_cache_destroy(prot->slab);
prot->slab = NULL; prot->slab = NULL;
}
out: out:
return -ENOBUFS; return ret;
} }
EXPORT_SYMBOL(proto_register); EXPORT_SYMBOL(proto_register);