Commit c96b6acc authored by Wang Hai's avatar Wang Hai Committed by David S. Miller
Browse files

dccp: Fix possible memleak in dccp_init and dccp_fini 



There are some memory leaks in dccp_init() and dccp_fini().

In dccp_fini() and the error handling path in dccp_init(), free lhash2
is missing. Add inet_hashinfo2_free_mod() to do it.

If inet_hashinfo2_init_mod() failed in dccp_init(),
percpu_counter_destroy() should be called to destroy dccp_orphan_count.
It need to goto out_free_percpu when inet_hashinfo2_init_mod() failed.

Fixes: c92c81df ("net: dccp: fix kernel crash on module load")
Reported-by: default avatarHulk Robot <hulkci@huawei.com>
Signed-off-by: default avatarWang Hai <wanghai38@huawei.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 976ee3b2

include/net/inet_hashtables.h

+6 −0
Original line number Diff line number Diff line
@@ -185,6 +185,12 @@ static inline spinlock_t *inet_ehash_lockp( 


int inet_ehash_locks_alloc(struct inet_hashinfo *hashinfo);



static inline void inet_hashinfo2_free_mod(struct inet_hashinfo *h)

{

	kfree(h->lhash2);

	h->lhash2 = NULL;

}



static inline void inet_ehash_locks_free(struct inet_hashinfo *hashinfo)

{

	kvfree(hashinfo->ehash_locks);

net/dccp/proto.c

+5 −2
Original line number Diff line number Diff line
@@ -1139,14 +1139,14 @@ static int __init dccp_init(void) 
	inet_hashinfo_init(&dccp_hashinfo);

	rc = inet_hashinfo2_init_mod(&dccp_hashinfo);

	if (rc)

		goto out_fail;

		goto out_free_percpu;

	rc = -ENOBUFS;

	dccp_hashinfo.bind_bucket_cachep =

		kmem_cache_create("dccp_bind_bucket",

				  sizeof(struct inet_bind_bucket), 0,

				  SLAB_HWCACHE_ALIGN, NULL);

	if (!dccp_hashinfo.bind_bucket_cachep)

		goto out_free_percpu;

		goto out_free_hashinfo2;



	/*

	 * Size and allocate the main established and bind bucket
@@ -1242,6 +1242,8 @@ out_free_dccp_ehash: 
	free_pages((unsigned long)dccp_hashinfo.ehash, ehash_order);

out_free_bind_bucket_cachep:

	kmem_cache_destroy(dccp_hashinfo.bind_bucket_cachep);

out_free_hashinfo2:

	inet_hashinfo2_free_mod(&dccp_hashinfo);

out_free_percpu:

	percpu_counter_destroy(&dccp_orphan_count);

out_fail:
@@ -1265,6 +1267,7 @@ static void __exit dccp_fini(void) 
	kmem_cache_destroy(dccp_hashinfo.bind_bucket_cachep);

	dccp_ackvec_exit();

	dccp_sysctl_exit();

	inet_hashinfo2_free_mod(&dccp_hashinfo);

	percpu_counter_destroy(&dccp_orphan_count);

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE