aboutsummaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorXin Long <lucien.xin@gmail.com>2017-07-26 14:19:09 +0800
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2017-08-11 08:33:57 -0700
commit01c23dffbca03bc7e22fe292deaaf5e550900155 (patch)
tree43fb9480054a243a36ee91dfb66d898ec7cc1149 /net
parent9431dc55af35edba5f8a52de255f3a76c8fba7ff (diff)
downloadlinux-yocto-4.12-01c23dffbca03bc7e22fe292deaaf5e550900155.tar.gz
linux-yocto-4.12-01c23dffbca03bc7e22fe292deaaf5e550900155.tar.bz2
linux-yocto-4.12-01c23dffbca03bc7e22fe292deaaf5e550900155.zip
dccp: fix a memleak that dccp_ipv6 doesn't put reqsk properly
[ Upstream commit 0c2232b0a71db0ac1d22f751aa1ac0cadb950fd2 ] In dccp_v6_conn_request, after reqsk gets alloced and hashed into ehash table, reqsk's refcnt is set 3. one is for req->rsk_timer, one is for hlist, and the other one is for current using. The problem is when dccp_v6_conn_request returns and finishes using reqsk, it doesn't put reqsk. This will cause reqsk refcnt leaks and reqsk obj never gets freed. Jianlin found this issue when running dccp_memleak.c in a loop, the system memory would run out. dccp_memleak.c: int s1 = socket(PF_INET6, 6, IPPROTO_IP); bind(s1, &sa1, 0x20); listen(s1, 0x9); int s2 = socket(PF_INET6, 6, IPPROTO_IP); connect(s2, &sa1, 0x20); close(s1); close(s2); This patch is to put the reqsk before dccp_v6_conn_request returns, just as what tcp_conn_request does. Reported-by: Jianlin Shi <jishi@redhat.com> Signed-off-by: Xin Long <lucien.xin@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net')
-rw-r--r--net/dccp/ipv6.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index 992621172220..cf3e40df4765 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -380,6 +380,7 @@ static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
goto drop_and_free;
inet_csk_reqsk_queue_hash_add(sk, req, DCCP_TIMEOUT_INIT);
+ reqsk_put(req);
return 0;
drop_and_free: