All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH 5/5] net/netfilter/ipvs: Eliminate memory leak
@ 2010-08-24 14:39 ` Julia Lawall
  0 siblings, 0 replies; 16+ messages in thread
From: Julia Lawall @ 2010-08-24 14:39 UTC (permalink / raw)
  To: Wensong Zhang, Simon Horman, Julian Anastasov, Patrick McHardy,
	David S. Miller, netdev, lvs-devel, netfilter-devel, netfilter,
	coreteam, linux-kernel, kernel-janitors

From: Julia Lawall <julia@diku.dk>

__ip_vs_service_get and __ip_vs_svc_fwm_get increment a reference count, so
that reference count should be decremented before leaving the function in an
error case.

A simplified version of the semantic match that finds this problem is:
(http://coccinelle.lip6.fr/)

// <smpl>
@r exists@
local idexpression x;
expression E;
identifier f1;
iterator I;
@@

x = __ip_vs_service_get(...);
<... when != x
     when != true (x == NULL || ...)
     when != if (...) { <+...x...+> }
     when != I (...) { <+...x...+> }
(
 x == NULL
|
 x == E
|
 x->f1
)
...>
* return ...;
// </smpl>

Signed-off-by: Julia Lawall <julia@diku.dk>

---
 net/netfilter/ipvs/ip_vs_ctl.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 0f0c079..f98169b 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -2155,7 +2155,7 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
 	if (cmd != IP_VS_SO_SET_ADD
 	    && (svc == NULL || svc->protocol != usvc.protocol)) {
 		ret = -ESRCH;
-		goto out_unlock;
+		goto out_drop_service;
 	}
 
 	switch (cmd) {
@@ -2189,6 +2189,7 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
 		ret = -EINVAL;
 	}
 
+out_drop_service:
 	if (svc)
 		ip_vs_service_put(svc);
 

^ permalink raw reply related	[flat|nested] 16+ messages in thread
* [PATCH 5/5] net/netfilter/ipvs: Eliminate memory leak
@ 2010-08-24 14:39 ` Julia Lawall
  0 siblings, 0 replies; 16+ messages in thread
From: Julia Lawall @ 2010-08-24 14:39 UTC (permalink / raw)
  To: Wensong Zhang, Simon Horman, Julian Anastasov, Patrick McHardy,
	David S. Miller, netdev, lvs-devel, netfilter-devel, netfilter,
	coreteam, linux-kernel, kernel-janitors

From: Julia Lawall <julia@diku.dk>

__ip_vs_service_get and __ip_vs_svc_fwm_get increment a reference count, so
that reference count should be decremented before leaving the function in an
error case.

A simplified version of the semantic match that finds this problem is:
(http://coccinelle.lip6.fr/)

// <smpl>
@r exists@
local idexpression x;
expression E;
identifier f1;
iterator I;
@@

x = __ip_vs_service_get(...);
<... when != x
     when != true (x = NULL || ...)
     when != if (...) { <+...x...+> }
     when != I (...) { <+...x...+> }
(
 x = NULL
|
 x = E
|
 x->f1
)
...>
* return ...;
// </smpl>

Signed-off-by: Julia Lawall <julia@diku.dk>

---
 net/netfilter/ipvs/ip_vs_ctl.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 0f0c079..f98169b 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -2155,7 +2155,7 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
 	if (cmd != IP_VS_SO_SET_ADD
 	    && (svc = NULL || svc->protocol != usvc.protocol)) {
 		ret = -ESRCH;
-		goto out_unlock;
+		goto out_drop_service;
 	}
 
 	switch (cmd) {
@@ -2189,6 +2189,7 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
 		ret = -EINVAL;
 	}
 
+out_drop_service:
 	if (svc)
 		ip_vs_service_put(svc);
 

^ permalink raw reply related	[flat|nested] 16+ messages in thread
* [PATCH 5/5] net/netfilter/ipvs: Eliminate memory leak
@ 2010-08-24 14:39 ` Julia Lawall
  0 siblings, 0 replies; 16+ messages in thread
From: Julia Lawall @ 2010-08-24 14:39 UTC (permalink / raw)
  To: Wensong Zhang, Simon Horman, Julian Anastasov, Patrick McHardy,
	David S. Miller, net

From: Julia Lawall <julia@diku.dk>

__ip_vs_service_get and __ip_vs_svc_fwm_get increment a reference count, so
that reference count should be decremented before leaving the function in an
error case.

A simplified version of the semantic match that finds this problem is:
(http://coccinelle.lip6.fr/)

// <smpl>
@r exists@
local idexpression x;
expression E;
identifier f1;
iterator I;
@@

x = __ip_vs_service_get(...);
<... when != x
     when != true (x == NULL || ...)
     when != if (...) { <+...x...+> }
     when != I (...) { <+...x...+> }
(
 x == NULL
|
 x == E
|
 x->f1
)
...>
* return ...;
// </smpl>

Signed-off-by: Julia Lawall <julia@diku.dk>

---
 net/netfilter/ipvs/ip_vs_ctl.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 0f0c079..f98169b 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -2155,7 +2155,7 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
 	if (cmd != IP_VS_SO_SET_ADD
 	    && (svc == NULL || svc->protocol != usvc.protocol)) {
 		ret = -ESRCH;
-		goto out_unlock;
+		goto out_drop_service;
 	}
 
 	switch (cmd) {
@@ -2189,6 +2189,7 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
 		ret = -EINVAL;
 	}
 
+out_drop_service:
 	if (svc)
 		ip_vs_service_put(svc);
 

^ permalink raw reply related	[flat|nested] 16+ messages in thread
* Re: [PATCH 5/5] net/netfilter/ipvs: Eliminate memory leak
  2010-08-24 14:39 ` Julia Lawall
@ 2010-08-25  1:34   ` Simon Horman
  -1 siblings, 0 replies; 16+ messages in thread
From: Simon Horman @ 2010-08-25  1:34 UTC (permalink / raw)
  To: Julia Lawall
  Cc: Wensong Zhang, Julian Anastasov, Patrick McHardy,
	David S. Miller, netdev, lvs-devel, netfilter-devel, netfilter,
	coreteam, linux-kernel, kernel-janitors

On Tue, Aug 24, 2010 at 04:39:49PM +0200, Julia Lawall wrote:
> From: Julia Lawall <julia@diku.dk>
> 
> __ip_vs_service_get and __ip_vs_svc_fwm_get increment a reference count, so
> that reference count should be decremented before leaving the function in an
> error case.
> 
> A simplified version of the semantic match that finds this problem is:
> (http://coccinelle.lip6.fr/)
> 
> // <smpl>
> @r exists@
> local idexpression x;
> expression E;
> identifier f1;
> iterator I;
> @@
> 
> x = __ip_vs_service_get(...);
> <... when != x
>      when != true (x == NULL || ...)
>      when != if (...) { <+...x...+> }
>      when != I (...) { <+...x...+> }
> (
>  x == NULL
> |
>  x == E
> |
>  x->f1
> )
> ...>
> * return ...;
> // </smpl>
> 
> Signed-off-by: Julia Lawall <julia@diku.dk>

Thanks Julia, that looks good to me.

Signed-off-by: Simon Horman <horms@verge.net.au>

Patrick, I guess that this should go through nf-next-2.6.

> 
> ---
>  net/netfilter/ipvs/ip_vs_ctl.c |    3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
> index 0f0c079..f98169b 100644
> --- a/net/netfilter/ipvs/ip_vs_ctl.c
> +++ b/net/netfilter/ipvs/ip_vs_ctl.c
> @@ -2155,7 +2155,7 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
>  	if (cmd != IP_VS_SO_SET_ADD
>  	    && (svc == NULL || svc->protocol != usvc.protocol)) {
>  		ret = -ESRCH;
> -		goto out_unlock;
> +		goto out_drop_service;
>  	}
>  
>  	switch (cmd) {
> @@ -2189,6 +2189,7 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
>  		ret = -EINVAL;
>  	}
>  
> +out_drop_service:
>  	if (svc)
>  		ip_vs_service_put(svc);
>  
> --
> To unsubscribe from this list: send the line "unsubscribe lvs-devel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

^ permalink raw reply	[flat|nested] 16+ messages in thread
* Re: [PATCH 5/5] net/netfilter/ipvs: Eliminate memory leak
@ 2010-08-25  1:34   ` Simon Horman
  0 siblings, 0 replies; 16+ messages in thread
From: Simon Horman @ 2010-08-25  1:34 UTC (permalink / raw)
  To: Julia Lawall
  Cc: Wensong Zhang, Julian Anastasov, Patrick McHardy,
	David S. Miller, netdev, lvs-devel, netfilter-devel, netfilter,
	coreteam, linux-kernel, kernel-janitors

On Tue, Aug 24, 2010 at 04:39:49PM +0200, Julia Lawall wrote:
> From: Julia Lawall <julia@diku.dk>
> 
> __ip_vs_service_get and __ip_vs_svc_fwm_get increment a reference count, so
> that reference count should be decremented before leaving the function in an
> error case.
> 
> A simplified version of the semantic match that finds this problem is:
> (http://coccinelle.lip6.fr/)
> 
> // <smpl>
> @r exists@
> local idexpression x;
> expression E;
> identifier f1;
> iterator I;
> @@
> 
> x = __ip_vs_service_get(...);
> <... when != x
>      when != true (x = NULL || ...)
>      when != if (...) { <+...x...+> }
>      when != I (...) { <+...x...+> }
> (
>  x = NULL
> |
>  x = E
> |
>  x->f1
> )
> ...>
> * return ...;
> // </smpl>
> 
> Signed-off-by: Julia Lawall <julia@diku.dk>

Thanks Julia, that looks good to me.

Signed-off-by: Simon Horman <horms@verge.net.au>

Patrick, I guess that this should go through nf-next-2.6.

> 
> ---
>  net/netfilter/ipvs/ip_vs_ctl.c |    3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
> index 0f0c079..f98169b 100644
> --- a/net/netfilter/ipvs/ip_vs_ctl.c
> +++ b/net/netfilter/ipvs/ip_vs_ctl.c
> @@ -2155,7 +2155,7 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
>  	if (cmd != IP_VS_SO_SET_ADD
>  	    && (svc = NULL || svc->protocol != usvc.protocol)) {
>  		ret = -ESRCH;
> -		goto out_unlock;
> +		goto out_drop_service;
>  	}
>  
>  	switch (cmd) {
> @@ -2189,6 +2189,7 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
>  		ret = -EINVAL;
>  	}
>  
> +out_drop_service:
>  	if (svc)
>  		ip_vs_service_put(svc);
>  
> --
> To unsubscribe from this list: send the line "unsubscribe lvs-devel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

^ permalink raw reply	[flat|nested] 16+ messages in thread
* Re: [PATCH 5/5] net/netfilter/ipvs: Eliminate memory leak
  2010-08-25  1:34   ` Simon Horman
@ 2010-08-25 23:38     ` David Miller
  -1 siblings, 0 replies; 16+ messages in thread
From: David Miller @ 2010-08-25 23:38 UTC (permalink / raw)
  To: horms
  Cc: julia, wensong, ja, kaber, netdev, lvs-devel, netfilter-devel,
	netfilter, coreteam, linux-kernel, kernel-janitors

From: Simon Horman <horms@verge.net.au>
Date: Wed, 25 Aug 2010 10:34:43 +0900

> On Tue, Aug 24, 2010 at 04:39:49PM +0200, Julia Lawall wrote:
>> Signed-off-by: Julia Lawall <julia@diku.dk>
> 
> Thanks Julia, that looks good to me.
> 
> Signed-off-by: Simon Horman <horms@verge.net.au>
> 
> Patrick, I guess that this should go through nf-next-2.6.

Since Patrick appears to be offline, I'll apply this directly so
he has less to do when he comes back online :)

Thanks.

^ permalink raw reply	[flat|nested] 16+ messages in thread
* Re: [PATCH 5/5] net/netfilter/ipvs: Eliminate memory leak
@ 2010-08-25 23:38     ` David Miller
  0 siblings, 0 replies; 16+ messages in thread
From: David Miller @ 2010-08-25 23:38 UTC (permalink / raw)
  To: horms
  Cc: julia, wensong, ja, kaber, netdev, lvs-devel, netfilter-devel,
	netfilter, coreteam, linux-kernel, kernel-janitors

From: Simon Horman <horms@verge.net.au>
Date: Wed, 25 Aug 2010 10:34:43 +0900

> On Tue, Aug 24, 2010 at 04:39:49PM +0200, Julia Lawall wrote:
>> Signed-off-by: Julia Lawall <julia@diku.dk>
> 
> Thanks Julia, that looks good to me.
> 
> Signed-off-by: Simon Horman <horms@verge.net.au>
> 
> Patrick, I guess that this should go through nf-next-2.6.

Since Patrick appears to be offline, I'll apply this directly so
he has less to do when he comes back online :)

Thanks.

^ permalink raw reply	[flat|nested] 16+ messages in thread
* Re: [PATCH 5/5] net/netfilter/ipvs: Eliminate memory leak
  2010-08-25 23:38     ` David Miller
@ 2010-08-26  0:32       ` Simon Horman
  -1 siblings, 0 replies; 16+ messages in thread
From: Simon Horman @ 2010-08-26  0:32 UTC (permalink / raw)
  To: David Miller
  Cc: julia, wensong, ja, kaber, netdev, lvs-devel, netfilter-devel,
	netfilter, coreteam, linux-kernel, kernel-janitors

On Wed, Aug 25, 2010 at 04:38:12PM -0700, David Miller wrote:
> From: Simon Horman <horms@verge.net.au>
> Date: Wed, 25 Aug 2010 10:34:43 +0900
> 
> > On Tue, Aug 24, 2010 at 04:39:49PM +0200, Julia Lawall wrote:
> >> Signed-off-by: Julia Lawall <julia@diku.dk>
> > 
> > Thanks Julia, that looks good to me.
> > 
> > Signed-off-by: Simon Horman <horms@verge.net.au>
> > 
> > Patrick, I guess that this should go through nf-next-2.6.
> 
> Since Patrick appears to be offline, I'll apply this directly so
> he has less to do when he comes back online :)

I have a handful of other changes queued up,
do you want to take them too?


^ permalink raw reply	[flat|nested] 16+ messages in thread
* Re: [PATCH 5/5] net/netfilter/ipvs: Eliminate memory leak
@ 2010-08-26  0:32       ` Simon Horman
  0 siblings, 0 replies; 16+ messages in thread
From: Simon Horman @ 2010-08-26  0:32 UTC (permalink / raw)
  To: David Miller
  Cc: julia, wensong, ja, kaber, netdev, lvs-devel, netfilter-devel,
	netfilter, coreteam, linux-kernel, kernel-janitors

On Wed, Aug 25, 2010 at 04:38:12PM -0700, David Miller wrote:
> From: Simon Horman <horms@verge.net.au>
> Date: Wed, 25 Aug 2010 10:34:43 +0900
> 
> > On Tue, Aug 24, 2010 at 04:39:49PM +0200, Julia Lawall wrote:
> >> Signed-off-by: Julia Lawall <julia@diku.dk>
> > 
> > Thanks Julia, that looks good to me.
> > 
> > Signed-off-by: Simon Horman <horms@verge.net.au>
> > 
> > Patrick, I guess that this should go through nf-next-2.6.
> 
> Since Patrick appears to be offline, I'll apply this directly so
> he has less to do when he comes back online :)

I have a handful of other changes queued up,
do you want to take them too?


^ permalink raw reply	[flat|nested] 16+ messages in thread
* Re: [PATCH 5/5] net/netfilter/ipvs: Eliminate memory leak
  2010-08-26  0:32       ` Simon Horman
@ 2010-08-26  3:56         ` David Miller
  -1 siblings, 0 replies; 16+ messages in thread
From: David Miller @ 2010-08-26  3:56 UTC (permalink / raw)
  To: horms
  Cc: julia, wensong, ja, kaber, netdev, lvs-devel, netfilter-devel,
	netfilter, coreteam, linux-kernel, kernel-janitors

From: Simon Horman <horms@verge.net.au>
Date: Thu, 26 Aug 2010 09:32:05 +0900

> I have a handful of other changes queued up,
> do you want to take them too?

Sure, let's do that.

^ permalink raw reply	[flat|nested] 16+ messages in thread
* Re: [PATCH 5/5] net/netfilter/ipvs: Eliminate memory leak
@ 2010-08-26  3:56         ` David Miller
  0 siblings, 0 replies; 16+ messages in thread
From: David Miller @ 2010-08-26  3:56 UTC (permalink / raw)
  To: horms
  Cc: julia, wensong, ja, kaber, netdev, lvs-devel, netfilter-devel,
	netfilter, coreteam, linux-kernel, kernel-janitors

From: Simon Horman <horms@verge.net.au>
Date: Thu, 26 Aug 2010 09:32:05 +0900

> I have a handful of other changes queued up,
> do you want to take them too?

Sure, let's do that.

^ permalink raw reply	[flat|nested] 16+ messages in thread
* Re: [PATCH 5/5] net/netfilter/ipvs: Eliminate memory leak
  2010-08-25 23:38     ` David Miller
@ 2010-09-16  5:42       ` Patrick McHardy
  -1 siblings, 0 replies; 16+ messages in thread
From: Patrick McHardy @ 2010-09-16  5:42 UTC (permalink / raw)
  To: David Miller
  Cc: horms, julia, wensong, ja, netdev, lvs-devel, netfilter-devel,
	netfilter, coreteam, linux-kernel, kernel-janitors

On 26.08.2010 01:38, David Miller wrote:
> From: Simon Horman <horms@verge.net.au>
> Date: Wed, 25 Aug 2010 10:34:43 +0900
> 
>> On Tue, Aug 24, 2010 at 04:39:49PM +0200, Julia Lawall wrote:
>>> Signed-off-by: Julia Lawall <julia@diku.dk>
>>
>> Thanks Julia, that looks good to me.
>>
>> Signed-off-by: Simon Horman <horms@verge.net.au>
>>
>> Patrick, I guess that this should go through nf-next-2.6.
> 
> Since Patrick appears to be offline, I'll apply this directly so
> he has less to do when he comes back online :)

Thanks Dave. I should be done catching up by tonight and will start
taking care of IPVS patches again.

^ permalink raw reply	[flat|nested] 16+ messages in thread
* Re: [PATCH 5/5] net/netfilter/ipvs: Eliminate memory leak
@ 2010-09-16  5:42       ` Patrick McHardy
  0 siblings, 0 replies; 16+ messages in thread
From: Patrick McHardy @ 2010-09-16  5:42 UTC (permalink / raw)
  To: David Miller
  Cc: horms, julia, wensong, ja, netdev, lvs-devel, netfilter-devel,
	netfilter, coreteam, linux-kernel, kernel-janitors

On 26.08.2010 01:38, David Miller wrote:
> From: Simon Horman <horms@verge.net.au>
> Date: Wed, 25 Aug 2010 10:34:43 +0900
> 
>> On Tue, Aug 24, 2010 at 04:39:49PM +0200, Julia Lawall wrote:
>>> Signed-off-by: Julia Lawall <julia@diku.dk>
>>
>> Thanks Julia, that looks good to me.
>>
>> Signed-off-by: Simon Horman <horms@verge.net.au>
>>
>> Patrick, I guess that this should go through nf-next-2.6.
> 
> Since Patrick appears to be offline, I'll apply this directly so
> he has less to do when he comes back online :)

Thanks Dave. I should be done catching up by tonight and will start
taking care of IPVS patches again.

^ permalink raw reply	[flat|nested] 16+ messages in thread
* [PATCH 5/5] net/netfilter/ipvs: Eliminate memory leak
@ 2010-08-24 14:39 Julia Lawall
  0 siblings, 0 replies; 16+ messages in thread
From: Julia Lawall @ 2010-08-24 14:39 UTC (permalink / raw)
  To: Wensong Zhang, Simon Horman, Julian Anastasov, Patrick McHardy,
	David S. Miller, net

From: Julia Lawall <julia@diku.dk>

__ip_vs_service_get and __ip_vs_svc_fwm_get increment a reference count, so
that reference count should be decremented before leaving the function in an
error case.

A simplified version of the semantic match that finds this problem is:
(http://coccinelle.lip6.fr/)

// <smpl>
@r exists@
local idexpression x;
expression E;
identifier f1;
iterator I;
@@

x = __ip_vs_service_get(...);
<... when != x
     when != true (x == NULL || ...)
     when != if (...) { <+...x...+> }
     when != I (...) { <+...x...+> }
(
 x == NULL
|
 x == E
|
 x->f1
)
...>
* return ...;
// </smpl>

Signed-off-by: Julia Lawall <julia@diku.dk>

---
 net/netfilter/ipvs/ip_vs_ctl.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 0f0c079..f98169b 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -2155,7 +2155,7 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
 	if (cmd != IP_VS_SO_SET_ADD
 	    && (svc == NULL || svc->protocol != usvc.protocol)) {
 		ret = -ESRCH;
-		goto out_unlock;
+		goto out_drop_service;
 	}
 
 	switch (cmd) {
@@ -2189,6 +2189,7 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
 		ret = -EINVAL;
 	}
 
+out_drop_service:
 	if (svc)
 		ip_vs_service_put(svc);
 

^ permalink raw reply related	[flat|nested] 16+ messages in thread
* [PATCH 5/5] net/netfilter/ipvs: Eliminate memory leak
@ 2010-08-24 14:39 Julia Lawall
  0 siblings, 0 replies; 16+ messages in thread
From: Julia Lawall @ 2010-08-24 14:39 UTC (permalink / raw)
  To: Wensong Zhang, Simon Horman, Julian Anastasov, Patrick McHardy,
	David S. Miller, net

From: Julia Lawall <julia@diku.dk>

__ip_vs_service_get and __ip_vs_svc_fwm_get increment a reference count, so
that reference count should be decremented before leaving the function in an
error case.

A simplified version of the semantic match that finds this problem is:
(http://coccinelle.lip6.fr/)

// <smpl>
@r exists@
local idexpression x;
expression E;
identifier f1;
iterator I;
@@

x = __ip_vs_service_get(...);
<... when != x
     when != true (x == NULL || ...)
     when != if (...) { <+...x...+> }
     when != I (...) { <+...x...+> }
(
 x == NULL
|
 x == E
|
 x->f1
)
...>
* return ...;
// </smpl>

Signed-off-by: Julia Lawall <julia@diku.dk>

---
 net/netfilter/ipvs/ip_vs_ctl.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 0f0c079..f98169b 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -2155,7 +2155,7 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
 	if (cmd != IP_VS_SO_SET_ADD
 	    && (svc == NULL || svc->protocol != usvc.protocol)) {
 		ret = -ESRCH;
-		goto out_unlock;
+		goto out_drop_service;
 	}
 
 	switch (cmd) {
@@ -2189,6 +2189,7 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
 		ret = -EINVAL;
 	}
 
+out_drop_service:
 	if (svc)
 		ip_vs_service_put(svc);
 

^ permalink raw reply related	[flat|nested] 16+ messages in thread
* [PATCH 5/5] net/netfilter/ipvs: Eliminate memory leak
@ 2010-08-24 14:39 Julia Lawall
  0 siblings, 0 replies; 16+ messages in thread
From: Julia Lawall @ 2010-08-24 14:39 UTC (permalink / raw)
  To: Wensong Zhang, Simon Horman, Julian Anastasov, Patrick McHardy,
	David S. Miller, net

From: Julia Lawall <julia@diku.dk>

__ip_vs_service_get and __ip_vs_svc_fwm_get increment a reference count, so
that reference count should be decremented before leaving the function in an
error case.

A simplified version of the semantic match that finds this problem is:
(http://coccinelle.lip6.fr/)

// <smpl>
@r exists@
local idexpression x;
expression E;
identifier f1;
iterator I;
@@

x = __ip_vs_service_get(...);
<... when != x
     when != true (x == NULL || ...)
     when != if (...) { <+...x...+> }
     when != I (...) { <+...x...+> }
(
 x == NULL
|
 x == E
|
 x->f1
)
...>
* return ...;
// </smpl>

Signed-off-by: Julia Lawall <julia@diku.dk>

---
 net/netfilter/ipvs/ip_vs_ctl.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 0f0c079..f98169b 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -2155,7 +2155,7 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
 	if (cmd != IP_VS_SO_SET_ADD
 	    && (svc == NULL || svc->protocol != usvc.protocol)) {
 		ret = -ESRCH;
-		goto out_unlock;
+		goto out_drop_service;
 	}
 
 	switch (cmd) {
@@ -2189,6 +2189,7 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
 		ret = -EINVAL;
 	}
 
+out_drop_service:
 	if (svc)
 		ip_vs_service_put(svc);
 

^ permalink raw reply related	[flat|nested] 16+ messages in thread
end of thread, other threads:[~2010-09-16  5:52 UTC | newest]

Thread overview: 16+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2010-08-24 14:39 [PATCH 5/5] net/netfilter/ipvs: Eliminate memory leak Julia Lawall
2010-08-24 14:39 ` Julia Lawall
2010-08-24 14:39 ` Julia Lawall
2010-08-25  1:34 ` Simon Horman
2010-08-25  1:34   ` Simon Horman
2010-08-25 23:38   ` David Miller
2010-08-25 23:38     ` David Miller
2010-08-26  0:32     ` Simon Horman
2010-08-26  0:32       ` Simon Horman
2010-08-26  3:56       ` David Miller
2010-08-26  3:56         ` David Miller
2010-09-16  5:42     ` Patrick McHardy
2010-09-16  5:42       ` Patrick McHardy
  -- strict thread matches above, loose matches on Subject: below --
2010-08-24 14:39 Julia Lawall
2010-08-24 14:39 Julia Lawall
2010-08-24 14:39 Julia Lawall

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.