* [PATCH net 1/2] rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle()
@ 2021-11-21 4:16 Eiichi Tsukata
2021-11-21 4:16 ` [PATCH net 2/2] rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer() Eiichi Tsukata
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: Eiichi Tsukata @ 2021-11-21 4:16 UTC (permalink / raw)
To: dhowells, marc.dionne, davem, kuba, linux-afs, netdev, linux-kernel
Cc: Eiichi Tsukata
Need to call rxrpc_put_peer() for bundle candidate before kfree() as it
holds a ref to rxrpc_peer.
Fixes: 245500d853e9 ("rxrpc: Rewrite the client connection manager")
Signed-off-by: Eiichi Tsukata <eiichi.tsukata@nutanix.com>
---
net/rxrpc/conn_client.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/rxrpc/conn_client.c b/net/rxrpc/conn_client.c
index dbea0bfee48e..46dcb33888ff 100644
--- a/net/rxrpc/conn_client.c
+++ b/net/rxrpc/conn_client.c
@@ -328,6 +328,7 @@ static struct rxrpc_bundle *rxrpc_look_up_bundle(struct rxrpc_conn_parameters *c
return candidate;
found_bundle_free:
+ rxrpc_put_peer(candidate->params.peer);
kfree(candidate);
found_bundle:
rxrpc_get_bundle(bundle);
--
2.33.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH net 2/2] rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer()
2021-11-21 4:16 [PATCH net 1/2] rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle() Eiichi Tsukata
@ 2021-11-21 4:16 ` Eiichi Tsukata
2021-11-23 14:11 ` Marc Dionne
2021-11-23 14:12 ` [PATCH net 1/2] rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle() Marc Dionne
2021-11-24 14:21 ` David Howells
2 siblings, 1 reply; 6+ messages in thread
From: Eiichi Tsukata @ 2021-11-21 4:16 UTC (permalink / raw)
To: dhowells, marc.dionne, davem, kuba, linux-afs, netdev, linux-kernel
Cc: Eiichi Tsukata
Need to call rxrpc_put_local() for peer candidate before kfree() as it
holds a ref to rxrpc_local.
Fixes: 9ebeddef58c4 ("rxrpc: rxrpc_peer needs to hold a ref on the rxrpc_local record")
Signed-off-by: Eiichi Tsukata <eiichi.tsukata@nutanix.com>
---
net/rxrpc/peer_object.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/net/rxrpc/peer_object.c b/net/rxrpc/peer_object.c
index 68396d052052..431b62bc1da2 100644
--- a/net/rxrpc/peer_object.c
+++ b/net/rxrpc/peer_object.c
@@ -364,10 +364,12 @@ struct rxrpc_peer *rxrpc_lookup_peer(struct rxrpc_sock *rx,
spin_unlock_bh(&rxnet->peer_hash_lock);
- if (peer)
+ if (peer) {
+ rxrpc_put_local(candidate->local);
kfree(candidate);
- else
+ } else {
peer = candidate;
+ }
}
_net("PEER %d {%pISp}", peer->debug_id, &peer->srx.transport);
--
2.33.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH net 2/2] rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer()
2021-11-21 4:16 ` [PATCH net 2/2] rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer() Eiichi Tsukata
@ 2021-11-23 14:11 ` Marc Dionne
0 siblings, 0 replies; 6+ messages in thread
From: Marc Dionne @ 2021-11-23 14:11 UTC (permalink / raw)
To: Eiichi Tsukata
Cc: David Howells, David Miller, Jakub Kicinski, linux-afs, netdev,
Linux Kernel Mailing List
On Sun, Nov 21, 2021 at 12:17 AM Eiichi Tsukata
<eiichi.tsukata@nutanix.com> wrote:
>
> Need to call rxrpc_put_local() for peer candidate before kfree() as it
> holds a ref to rxrpc_local.
>
> Fixes: 9ebeddef58c4 ("rxrpc: rxrpc_peer needs to hold a ref on the rxrpc_local record")
> Signed-off-by: Eiichi Tsukata <eiichi.tsukata@nutanix.com>
> ---
> net/rxrpc/peer_object.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/net/rxrpc/peer_object.c b/net/rxrpc/peer_object.c
> index 68396d052052..431b62bc1da2 100644
> --- a/net/rxrpc/peer_object.c
> +++ b/net/rxrpc/peer_object.c
> @@ -364,10 +364,12 @@ struct rxrpc_peer *rxrpc_lookup_peer(struct rxrpc_sock *rx,
>
> spin_unlock_bh(&rxnet->peer_hash_lock);
>
> - if (peer)
> + if (peer) {
> + rxrpc_put_local(candidate->local);
> kfree(candidate);
> - else
> + } else {
> peer = candidate;
> + }
> }
>
> _net("PEER %d {%pISp}", peer->debug_id, &peer->srx.transport);
> --
> 2.33.1
Reviewed-by: Marc Dionne <marc.dionne@auristor.com>
Marc
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH net 1/2] rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle()
2021-11-21 4:16 [PATCH net 1/2] rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle() Eiichi Tsukata
2021-11-21 4:16 ` [PATCH net 2/2] rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer() Eiichi Tsukata
@ 2021-11-23 14:12 ` Marc Dionne
2021-11-24 14:21 ` David Howells
2 siblings, 0 replies; 6+ messages in thread
From: Marc Dionne @ 2021-11-23 14:12 UTC (permalink / raw)
To: Eiichi Tsukata
Cc: David Howells, David Miller, Jakub Kicinski, linux-afs, netdev,
Linux Kernel Mailing List
On Sun, Nov 21, 2021 at 12:17 AM Eiichi Tsukata
<eiichi.tsukata@nutanix.com> wrote:
>
> Need to call rxrpc_put_peer() for bundle candidate before kfree() as it
> holds a ref to rxrpc_peer.
>
> Fixes: 245500d853e9 ("rxrpc: Rewrite the client connection manager")
> Signed-off-by: Eiichi Tsukata <eiichi.tsukata@nutanix.com>
> ---
> net/rxrpc/conn_client.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/net/rxrpc/conn_client.c b/net/rxrpc/conn_client.c
> index dbea0bfee48e..46dcb33888ff 100644
> --- a/net/rxrpc/conn_client.c
> +++ b/net/rxrpc/conn_client.c
> @@ -328,6 +328,7 @@ static struct rxrpc_bundle *rxrpc_look_up_bundle(struct rxrpc_conn_parameters *c
> return candidate;
>
> found_bundle_free:
> + rxrpc_put_peer(candidate->params.peer);
> kfree(candidate);
> found_bundle:
> rxrpc_get_bundle(bundle);
> --
> 2.33.1
Reviewed-by: Marc Dionne <marc.dionne@auristor.com>
Marc
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH net 1/2] rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle()
2021-11-21 4:16 [PATCH net 1/2] rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle() Eiichi Tsukata
2021-11-21 4:16 ` [PATCH net 2/2] rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer() Eiichi Tsukata
2021-11-23 14:12 ` [PATCH net 1/2] rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle() Marc Dionne
@ 2021-11-24 14:21 ` David Howells
2 siblings, 0 replies; 6+ messages in thread
From: David Howells @ 2021-11-24 14:21 UTC (permalink / raw)
To: Eiichi Tsukata
Cc: dhowells, marc.dionne, davem, kuba, linux-afs, netdev, linux-kernel
Looks good, though I think a better way to do both of these cases is to
abstract out the freeing sequence into its own function.
David
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH net 0/2] rxrpc: Leak fixes
@ 2021-11-29 15:49 David Howells
2021-11-29 15:49 ` [PATCH net 1/2] rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle() David Howells
0 siblings, 1 reply; 6+ messages in thread
From: David Howells @ 2021-11-29 15:49 UTC (permalink / raw)
To: netdev
Cc: linux-afs, Marc Dionne, Eiichi Tsukata, dhowells, linux-afs,
linux-kernel
Here are a couple of fixes for leaks in AF_RXRPC:
(1) Fix a leak of rxrpc_peer structs in rxrpc_look_up_bundle().
(2) Fix a leak of rxrpc_local structs in rxrpc_lookup_peer().
The patches are tagged here:
git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git
rxrpc-fixes-20211129
and can also be found on the following branch:
http://git.kernel.org/cgit/linux/kernel/git/dhowells/linux-fs.git/log/?h=rxrpc-fixes
David
---
Eiichi Tsukata (2):
rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle()
rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer()
net/rxrpc/peer_object.c | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
^ permalink raw reply [flat|nested] 6+ messages in thread* [PATCH net 1/2] rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle()
2021-11-29 15:49 [PATCH net 0/2] rxrpc: Leak fixes David Howells
@ 2021-11-29 15:49 ` David Howells
0 siblings, 0 replies; 6+ messages in thread
From: David Howells @ 2021-11-29 15:49 UTC (permalink / raw)
To: netdev
Cc: Eiichi Tsukata, Marc Dionne, linux-afs, dhowells, linux-afs,
linux-kernel
From: Eiichi Tsukata <eiichi.tsukata@nutanix.com>
Need to call rxrpc_put_peer() for bundle candidate before kfree() as it
holds a ref to rxrpc_peer.
[DH: v2: Changed to abstract out the bundle freeing code into a function]
Fixes: 245500d853e9 ("rxrpc: Rewrite the client connection manager")
Signed-off-by: Eiichi Tsukata <eiichi.tsukata@nutanix.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Link: https://lore.kernel.org/r/20211121041608.133740-1-eiichi.tsukata@nutanix.com/ # v1
---
net/rxrpc/conn_client.c | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
diff --git a/net/rxrpc/conn_client.c b/net/rxrpc/conn_client.c
index dbea0bfee48e..8120138dac01 100644
--- a/net/rxrpc/conn_client.c
+++ b/net/rxrpc/conn_client.c
@@ -135,16 +135,20 @@ struct rxrpc_bundle *rxrpc_get_bundle(struct rxrpc_bundle *bundle)
return bundle;
}
+static void rxrpc_free_bundle(struct rxrpc_bundle *bundle)
+{
+ rxrpc_put_peer(bundle->params.peer);
+ kfree(bundle);
+}
+
void rxrpc_put_bundle(struct rxrpc_bundle *bundle)
{
unsigned int d = bundle->debug_id;
unsigned int u = atomic_dec_return(&bundle->usage);
_debug("PUT B=%x %u", d, u);
- if (u == 0) {
- rxrpc_put_peer(bundle->params.peer);
- kfree(bundle);
- }
+ if (u == 0)
+ rxrpc_free_bundle(bundle);
}
/*
@@ -328,7 +332,7 @@ static struct rxrpc_bundle *rxrpc_look_up_bundle(struct rxrpc_conn_parameters *c
return candidate;
found_bundle_free:
- kfree(candidate);
+ rxrpc_free_bundle(candidate);
found_bundle:
rxrpc_get_bundle(bundle);
spin_unlock(&local->client_bundles_lock);
^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2021-11-29 15:51 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-11-21 4:16 [PATCH net 1/2] rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle() Eiichi Tsukata
2021-11-21 4:16 ` [PATCH net 2/2] rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer() Eiichi Tsukata
2021-11-23 14:11 ` Marc Dionne
2021-11-23 14:12 ` [PATCH net 1/2] rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle() Marc Dionne
2021-11-24 14:21 ` David Howells
2021-11-29 15:49 [PATCH net 0/2] rxrpc: Leak fixes David Howells
2021-11-29 15:49 ` [PATCH net 1/2] rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle() David Howells
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).