From: Mao Wenan <maowenan@huawei.com>
To: <vyasevich@gmail.com>, <nhorman@tuxdriver.com>,
<marcelo.leitner@gmail.com>, <davem@davemloft.net>
Cc: <linux-sctp@vger.kernel.org>, <netdev@vger.kernel.org>,
<linux-kernel@vger.kernel.org>, <kernel-janitors@vger.kernel.org>,
Mao Wenan <maowenan@huawei.com>, Hulk Robot <hulkci@huawei.com>
Subject: [PATCH v2 net 3/3] sctp: destroy bucket if failed to bind addr
Date: Thu, 12 Sep 2019 12:02:19 +0800 [thread overview]
Message-ID: <20190912040219.67517-4-maowenan@huawei.com> (raw)
In-Reply-To: <20190912040219.67517-1-maowenan@huawei.com>
There is one memory leak bug report:
BUG: memory leak
unreferenced object 0xffff8881dc4c5ec0 (size 40):
comm "syz-executor.0", pid 5673, jiffies 4298198457 (age 27.578s)
hex dump (first 32 bytes):
02 00 00 00 81 88 ff ff 00 00 00 00 00 00 00 00 ................
f8 63 3d c1 81 88 ff ff 00 00 00 00 00 00 00 00 .c=.............
backtrace:
[<0000000072006339>] sctp_get_port_local+0x2a1/0xa00 [sctp]
[<00000000c7b379ec>] sctp_do_bind+0x176/0x2c0 [sctp]
[<000000005be274a2>] sctp_bind+0x5a/0x80 [sctp]
[<00000000b66b4044>] inet6_bind+0x59/0xd0 [ipv6]
[<00000000c68c7f42>] __sys_bind+0x120/0x1f0 net/socket.c:1647
[<000000004513635b>] __do_sys_bind net/socket.c:1658 [inline]
[<000000004513635b>] __se_sys_bind net/socket.c:1656 [inline]
[<000000004513635b>] __x64_sys_bind+0x3e/0x50 net/socket.c:1656
[<0000000061f2501e>] do_syscall_64+0x72/0x2e0 arch/x86/entry/common.c:296
[<0000000003d1e05e>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
This is because in sctp_do_bind, if sctp_get_port_local is to
create hash bucket successfully, and sctp_add_bind_addr failed
to bind address, e.g return -ENOMEM, so memory leak found, it
needs to destroy allocated bucket.
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Mao Wenan <maowenan@huawei.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
---
net/sctp/socket.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 2f810078c91d..69ec3b796197 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -412,11 +412,13 @@ static int sctp_do_bind(struct sock *sk, union sctp_addr *addr, int len)
ret = sctp_add_bind_addr(bp, addr, af->sockaddr_len,
SCTP_ADDR_SRC, GFP_ATOMIC);
- /* Copy back into socket for getsockname() use. */
- if (!ret) {
- inet_sk(sk)->inet_sport = htons(inet_sk(sk)->inet_num);
- sp->pf->to_sk_saddr(addr, sk);
+ if (ret) {
+ sctp_put_port(sk);
+ return ret;
}
+ /* Copy back into socket for getsockname() use. */
+ inet_sk(sk)->inet_sport = htons(inet_sk(sk)->inet_num);
+ sp->pf->to_sk_saddr(addr, sk);
return ret;
}
--
2.20.1
next prev parent reply other threads:[~2019-09-12 3:45 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-09-10 7:13 [PATCH net 0/2] fix memory leak for sctp_do_bind Mao Wenan
2019-09-10 7:13 ` [PATCH net 1/2] sctp: remove redundant assignment when call sctp_get_port_local Mao Wenan
2019-09-10 18:57 ` Dan Carpenter
2019-09-10 19:22 ` Dan Carpenter
2019-09-11 1:30 ` maowenan
2019-09-11 8:30 ` Dan Carpenter
2019-09-11 14:30 ` Marcelo Ricardo Leitner
2019-09-11 14:39 ` Marcelo Ricardo Leitner
2019-09-12 2:05 ` maowenan
2019-09-12 4:02 ` [PATCH v2 net 0/3] fix memory leak for sctp_do_bind Mao Wenan
2019-09-12 4:02 ` [PATCH v2 net 1/3] sctp: change return type of sctp_get_port_local Mao Wenan
2019-09-12 14:51 ` Marcelo Ricardo Leitner
2019-09-12 4:02 ` [PATCH v2 net 2/3] sctp: remove redundant assignment when call sctp_get_port_local Mao Wenan
2019-09-12 14:52 ` Marcelo Ricardo Leitner
2019-09-12 4:02 ` Mao Wenan [this message]
2019-09-12 14:52 ` [PATCH v2 net 3/3] sctp: destroy bucket if failed to bind addr Marcelo Ricardo Leitner
2019-09-13 20:06 ` [PATCH v2 net 0/3] fix memory leak for sctp_do_bind David Miller
2019-09-10 7:13 ` [PATCH net 2/2] sctp: destroy bucket if failed to bind addr Mao Wenan
2019-09-10 7:16 ` [PATCH net 0/2] fix memory leak for sctp_do_bind Neil Horman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190912040219.67517-4-maowenan@huawei.com \
--to=maowenan@huawei.com \
--cc=davem@davemloft.net \
--cc=hulkci@huawei.com \
--cc=kernel-janitors@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-sctp@vger.kernel.org \
--cc=marcelo.leitner@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=nhorman@tuxdriver.com \
--cc=vyasevich@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).