lkml.org 
[lkml]   [2020]   [Nov]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 143/151] tipc: fix memory leak in tipc_topsrv_start()
    Date
    From: Wang Hai <wanghai38@huawei.com>

    [ Upstream commit fa6882c63621821f73cc806f291208e1c6ea6187 ]

    kmemleak report a memory leak as follows:

    unreferenced object 0xffff88810a596800 (size 512):
    comm "ip", pid 21558, jiffies 4297568990 (age 112.120s)
    hex dump (first 32 bytes):
    00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N..........
    ff ff ff ff ff ff ff ff 00 83 60 b0 ff ff ff ff ..........`.....
    backtrace:
    [<0000000022bbe21f>] tipc_topsrv_init_net+0x1f3/0xa70
    [<00000000fe15ddf7>] ops_init+0xa8/0x3c0
    [<00000000138af6f2>] setup_net+0x2de/0x7e0
    [<000000008c6807a3>] copy_net_ns+0x27d/0x530
    [<000000006b21adbd>] create_new_namespaces+0x382/0xa30
    [<00000000bb169746>] unshare_nsproxy_namespaces+0xa1/0x1d0
    [<00000000fe2e42bc>] ksys_unshare+0x39c/0x780
    [<0000000009ba3b19>] __x64_sys_unshare+0x2d/0x40
    [<00000000614ad866>] do_syscall_64+0x56/0xa0
    [<00000000a1b5ca3c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

    'srv' is malloced in tipc_topsrv_start() but not free before
    leaving from the error handling cases. We need to free it.

    Fixes: 5c45ab24ac77 ("tipc: make struct tipc_server private for server.c")
    Reported-by: Hulk Robot <hulkci@huawei.com>
    Signed-off-by: Wang Hai <wanghai38@huawei.com>
    Link: https://lore.kernel.org/r/20201109140913.47370-1-wanghai38@huawei.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/tipc/topsrv.c | 10 ++++++++--
    1 file changed, 8 insertions(+), 2 deletions(-)

    --- a/net/tipc/topsrv.c
    +++ b/net/tipc/topsrv.c
    @@ -664,12 +664,18 @@ static int tipc_topsrv_start(struct net

    ret = tipc_topsrv_work_start(srv);
    if (ret < 0)
    - return ret;
    + goto err_start;

    ret = tipc_topsrv_create_listener(srv);
    if (ret < 0)
    - tipc_topsrv_work_stop(srv);
    + goto err_create;

    + return 0;
    +
    +err_create:
    + tipc_topsrv_work_stop(srv);
    +err_start:
    + kfree(srv);
    return ret;
    }


    \
     
     \ /
      Last update: 2020-11-17 14:39    [W:4.071 / U:0.028 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site