From: David Howells <dhowells@redhat.com>
To: Eiichi Tsukata <eiichi.tsukata@nutanix.com>
Cc: Marc Dionne <marc.dionne@auristor.com>,
linux-afs@lists.infradead.org, dhowells@redhat.com,
kuba@kernel.org, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: [PATCH 2/2] rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer()
Date: Wed, 24 Nov 2021 14:37:40 +0000 [thread overview]
Message-ID: <163776466062.1844202.16759821367213247018.stgit@warthog.procyon.org.uk> (raw)
In-Reply-To: <163776465314.1844202.9057900281265187616.stgit@warthog.procyon.org.uk>
From: Eiichi Tsukata <eiichi.tsukata@nutanix.com>
Need to call rxrpc_put_local() for peer candidate before kfree() as it
holds a ref to rxrpc_local.
[DH: v2: Changed to abstract the peer freeing code out into a function]
Fixes: 9ebeddef58c4 ("rxrpc: rxrpc_peer needs to hold a ref on the rxrpc_local record")
Signed-off-by: Eiichi Tsukata <eiichi.tsukata@nutanix.com>
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Link: https://lore.kernel.org/all/20211121041608.133740-2-eiichi.tsukata@nutanix.com/ # v1
---
net/rxrpc/peer_object.c | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
diff --git a/net/rxrpc/peer_object.c b/net/rxrpc/peer_object.c
index 68396d052052..0298fe2ad6d3 100644
--- a/net/rxrpc/peer_object.c
+++ b/net/rxrpc/peer_object.c
@@ -299,6 +299,12 @@ static struct rxrpc_peer *rxrpc_create_peer(struct rxrpc_sock *rx,
return peer;
}
+static void rxrpc_free_peer(struct rxrpc_peer *peer)
+{
+ rxrpc_put_local(peer->local);
+ kfree_rcu(peer, rcu);
+}
+
/*
* Set up a new incoming peer. There shouldn't be any other matching peers
* since we've already done a search in the list from the non-reentrant context
@@ -365,7 +371,7 @@ struct rxrpc_peer *rxrpc_lookup_peer(struct rxrpc_sock *rx,
spin_unlock_bh(&rxnet->peer_hash_lock);
if (peer)
- kfree(candidate);
+ rxrpc_free_peer(candidate);
else
peer = candidate;
}
@@ -420,8 +426,7 @@ static void __rxrpc_put_peer(struct rxrpc_peer *peer)
list_del_init(&peer->keepalive_link);
spin_unlock_bh(&rxnet->peer_hash_lock);
- rxrpc_put_local(peer->local);
- kfree_rcu(peer, rcu);
+ rxrpc_free_peer(peer);
}
/*
@@ -457,8 +462,7 @@ void rxrpc_put_peer_locked(struct rxrpc_peer *peer)
if (n == 0) {
hash_del_rcu(&peer->hash_link);
list_del_init(&peer->keepalive_link);
- rxrpc_put_local(peer->local);
- kfree_rcu(peer, rcu);
+ rxrpc_free_peer(peer);
}
}
next prev parent reply other threads:[~2021-11-24 14:38 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-11-24 14:37 [PATCH 1/2] rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle() David Howells
2021-11-24 14:37 ` David Howells [this message]
2021-11-26 13:15 ` [PATCH 2/2] rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer() Marc Dionne
2021-11-26 3:27 ` [PATCH 1/2] rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle() Jakub Kicinski
2021-11-26 8:05 ` David Howells
2021-11-26 8:34 ` Eiichi Tsukata
2021-11-29 15:40 ` David Howells
2021-11-26 13:12 ` Marc Dionne
2021-11-29 15:53 ` David Howells
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=163776466062.1844202.16759821367213247018.stgit@warthog.procyon.org.uk \
--to=dhowells@redhat.com \
--cc=eiichi.tsukata@nutanix.com \
--cc=kuba@kernel.org \
--cc=linux-afs@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=marc.dionne@auristor.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).